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ABSTHACT 


This  thesis  presents  an  implementation  of  segment 
management  for  the  security  kernel  of  a  secure  archival 
storage  system.  The  oasis  for  this  implementation  is  a 
family  of  secure,  distributed,  multi-microprocessor 
operating  systems  designed  to  provide  multilevel  internal 
computer  security  and  controlled  sharing  of  data  among 
authorized  users.  This  implementation  provides  address  space 
management  for  individual  processes,  "based  on  segmentation 
as  a  memory  management  scheme.  Non-discretionary  information 
security  is  provided  through  enforcement  of  a  security 
policy  "based  on  a  lattice  structure  that  allows  flexibility 
in  representing  different  security  policies;  the  Department 
of  Defense  (DoD)  security  classification  system  is  the 
security  policy  represented  in  this  thesis.  Implementation 
was  completed  on  the  ZILOG  Z8000  microprocessor. 
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I.   INTRODUCTION 

This  thesis  addresses  the  implementation  of  the  segment 
management  functions  of  an  operating  system  known  as  the 
Secure  Archival  Storage  System  or  SASS.  This  system,  with 
full  implementation,  will  provide:  (1)  multilevel  secure 
access  to  information  (files)  stored  in  a  "data  warehouse" 
for  a  network  of  multiple  host  computers,  and  (2)  controlled 
data  sharing  among  authorized  users.  The  correct  performance 
of  hoth  of  these  features  is  directly  dependent  upon  the 
proper  implementation  of  the  segment  management  functions 
addressed  in  this  thesis.  The  issue  of  access  to  sensitive 
information  is  addressed  hy  the  Non-Discretionary  Security 
Module,  which  mediates  all  non-discretionary  access  to 
information.  Sharing  of  information  is  accomplished  chiefly 
through  the  properties  of  segmentation,  the  SASS  memory 
management  scheme  that  is  supported  hy  the  Memory  Manager 
Module  and  the  Segment  Manager  Module.  The  implementation  of 
segment  management  for  SASS  is  thus  integral  to  the 
attainment  of  the  two  key  goals  that  SASS  was  designed  to 
achieve.  This  implementation  addresses  the  Non-Discretionary 
Security,  Distributed  Memory  Manager  (the  interface  to  the 
Memory  Manager  Process"),  and  Segment  Manager  modules. 
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A.   BACKGROUND 

O'Connell  and  Richardson  provided  the  design  for  a 
family  of  secure,  distributed,  multi-microprocessor 
operating  systems  from  which  the  subset,  SASS,  was  later 
derived  [6].  In  their  work,  two  of  the  primary  motivations 
were  to  provide  a  system  that  (l)  effectively  coordinated 
the  processing  power  of  microprocessors  and  (2)  provided 
information  security. 

The  basis  for  emphasis  on  utilization  of  microprocessors 
is  not  purely  that  of  replacing  software  with  more  powerful 
(and  faster)  hardware  (microprocessors)  but  is  also  an 
economic  issue.  Software  development  and  computing 
operations  are  becoming  more  and  more  expensive,  putting 
further  pressure  on  system  designers  to  increasingly  utilize 
people  solely  for  system  functions  that  computers  cannot 
perform  in  a  cost  effective  manner.  Microcomputers,  on  the 
other  hand,  are  becoming  less  and  less  expensive  and  are, 
therefore,  increasingly  being  used  for  more  functions. 

The  need  for  information  security  has  been  gradually 
recognized  as  the  uses  of  computers  have  expanded.  As 
security  needs  for  specific  computer  systems  have  been 
recognized,  attempts  have  been  made  to  modify  the  existing 
systems  to  provide  the  desired  security.  The  results  have 
been  systems  that  could  not  be  certified  as  secure  and/or 
which  have  failed  to  resist  penetration  efforts,  i.e. 
systems   which,   in   effect,  did  not   provide  adequate 
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information  security.  It  has  become  clear  that,  in  order  to 
be  certifiably  secure,  a  computer  system  must  have  security 
designed  in  from  first  principles  [10,11] .  Such  is  the  case 
with  SASS.  Information  security  was  and  continues  to  "be  a 
chief  design  feature.  Integral  to  the  design  goal  of 
information  security  were  two  related  £oals.  One  of  these 
goals  was  to  provide  multilevel  controlled  access  to  a 
consolidated  "warehouse"  of  data  for  a  network  of  multiple 
host  computers.  The  other  key  goal  was  to  provide  for 
controlled  sharing  among  the  computer  hosts. 

A  brief  background  of  prior  work  relative  to  SASS 
follows.  O'Connell  and  Richardson  originated  the  design  of  a 
secure  family  of  operating  systems.  Their  design  provided 
two  basic  parts  for  their  system  —  the  supervisor  (to 
provide  operating  system  services)  and  the  kernel  (to 
provide  for  physical  resource  management).  The  design  of  the 
SASS  supervisor  was  completed  by  Parks  [7]  .  No 
implementation  or  further  design  effort  on  the  supervior  has 
followed,  to  date.  The  initial  design  of  the  kernel  was 
completed  by  Coleman  [l] .  That  design  described  the  kernel 
in  terms  of  seven  modules: 


1.  Gate  Keeper  Module  —  provided  for  ring-crossing 
mechanism  and  thus  isolation  of  the  kernel. 

2.  Segment  Manager  Module  —  provided  for  management  of 
segmented  virtual  memory. 

3.  Traffic  Controller  Module  —  multiplexed  processes 
onto  virtual  processors  and  supports  the  inter- 
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process  communication  primitives  Block  and  Wakeup. 
Block  and  Wakeup. 

4.  Non-Discretionary  Security  Module  —  mediated 
non-discretionary  security  access  attempts. 

5.  Inner  Traffic  Controller  Module  —  multiplexed 
virtual  processors  onto  real  processors  and 
provided  the  Kernel  synchronization  primitives 
Signal  and  Walt. 

6.  Memory  Manager  Module  —  managed  main  memory  and 
secondary  storage. 

7.  Input-Output  Manager  —  managed  the  moving  of 
information  to  external  devices  outside  the 
"boundaries  of  the  SASS . 

Refinement  of  the  kernel  design  and  partial   implementation 

was   completed  hy  Gary  and  Moore  [4]  in  conjunction  with 

Reitz  [9] •  The  resultant  description  of   the  kernel   as  a 

result  of  their  work  was: 

1.  Gate  Keeper  Module 

2.  Segment  Manager  Module 

3.  Event  Manager  Module  —  worked  with  the 
Traffic  Controller  to  manage  the  "event 
data"  associated  with  the  IPC  mechanism 
of  eventcounts  and  sequencers. 

4.  Non-Discretionary  Security  Module 

5.  Traffic  Controller  Module  —  replaced 
Block  and  Wakeup  with  Advance  and  Await 
(to  implement  Supervisor  IPC  mechanism  of 
eventcounts  and  sequencers). 

6.  Memory  Manager  Module 

7.  Inner  Traffic  Controller  Module 

Reitz   implemented   the  Traffic  Controller  Module  and  Inner 
Traffic  Controller  Module.   Gary  and  Moore   completed   a 
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detailed  design  of  the  Memory  Manager,  originated  the  Memory 
Manager  code  (written  predominantly  in  PLZ/SYS),  selected  a 
thread  of  the  code,  hand  compiled  it  into  PLZ/ASM  and  ran  it 
on  the  Z8000  developmental  module. 

The  design  and  implementation  works  mentioned  above 
provided  the  design  base  for  this  implementation. 
Refinements  were  made  as  needed  and  are  discussed  in 
Appendix  G  of  this  thesis.  A  broader  description  of  the 
current  state  of  SASS  will  he  provided  in  the  next  section. 

B.   SECURE  ARCHIVAL  STORAGE  SYSTEM  OVERVIEW 

This  section  presents  a  brief  summary  of  the  current 
design  state  of  the  Secure  Archival  Storage  System.  The 
purpose  of  this  summary  is  to  provide  continuity  (interface) 
between  this  and  previous  work  relative  to  SASS,  and  to 
enhance  understanding  of  the  evolution  of  the  more  detailed 
and  system  specific  information  provided  later  in  this 
thesis. 

1.   Levels  of  Abstraction 

The  original  design  for  a  family  of  secure, 
distributed  operating  systems  (which  was  the  basis  for  the 
development  of  SASS)  used  effectively  the  concept  of  levels 
of  abstraction  as  a  design  methodology  tool.  Just  as  this 
tool  allows  for  clarity  and  simplification  in 
conceptualizing  and  designing  a  system,  it  also  enhances  the 
ability  to  clearly  and   succinctly  describe   that   system's 
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design.  Thus,  an  abstract  system  overview  (description)  of 
SASS  will  be  presented  here.  Figure  1  represents  that 
overview  (illustrated  for  a  single  host  system  for  clarity). 
There  are  four  levels  of  abstraction: 

Level  3  —  the  Host  computer  systems 

level  2  —  the  Supervisor 

Level  1  —  the  Kernel 

Level  0  —  the  Hardware 
The  Gate  Keeper  Module  is  logically  the  boundary  between  the 
Supervisor  and   the  Kernel  and  thus  will  not  be  discussed 
within  either  of  these  levels,  but  rather  separately. 

2.   Level  Three  -  Host  Computer(s) 

Level  three  consists  of  the  Host  computer  systems. 
There  may  be  a  variable  number  of  host  computers  of  any  type 
(e.g.,  micro,  mini,  etc).  Each  host  may  be  used  to  create 
and  manipulate  files  of  a  fixed,  predetermined  degree  of 
sensitivity  (or  security  classification).  Once  a  user  of  a 
host  computer  system  completes  work  on  a  particular  file, 
they  can  permanently  store  that  file  on  the  SASS  (and,  of 
course,  may  later  again  access  the  same  file  by  requesting 
the  SASS  to  provide  it  to.  them).  Each  host  computer  system 
is  individually  wired  to  an  I/O  port  of  the  Z8001.  Each  of 
the  ports  has  fixed  access  level. 
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Figure   1.   SASS  System  Overview  (Single  Host) 
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If  a  multilevel  secure  Host  desires  to  handle  data 
at  two  levels  (e.g.,  secret  and  unclassified),  it  will  use 
two   connections   to  the  SASS.  Physical  and/or  cryptographic 
protection  of  the  hardwire  connections  is  assumed. 
3.  Level  Two  -  Supervisor 

level  two  is  the  Supervisor.  A  proper  description  of 
the  Supervisor  is  "that  component  of  the  SASS  that  executes 
in  the  outer,  less  privileged  domain  (normal  mode)  of  the 
Z8001  microprocessor,  and  is  responsible  for  the  SASS  -  Host 
computer  interface".  Integral  to  this  description  (and  the 
Kernel's  description)  is  the  concept  of  a  "domain",  that  can 
"be  described  using  four  other  terms  that  also  need  to  be 
defined:  "process",  "address  space"*  "segment",  and 
"segmentation".  Madnick  and  Donovan  [5]  define  a  process  as 
the  locus  of  points  of  a  processor  executing  a  collection  of 
programs;  the  collection  of  programs  and  data  that  are 
accessed  in  a  process  forms  that  process's  address  space.  A 
segment  is  defined  as  a  logical  grouping  of  information, 
such  as  a  subroutine,  array,  or  data  area,  and  segmentation 
is  defined  as  the  technique  for  managing  segments  of  an 
address  space.  It  is  convenient  then,  since  the  SASS  uses 
segmentation  as  a  memory  management  scheme,  to  more 
specifically  define  a  SASS  process  address  space  as  the 
collection  of  segments  that  are  accessed  (or  are  accessible) 
in  that  process.  A  domain  is  conceptualized  in  SASS  due  to 
the   necessity  to   isolate   the   Kernel   from  all  possible 

17 


outside  influences.  To  achieve  this,  a  process'  address 
space  is  divided  into  a  hierarchial  arrangement  of  segment 
accessibility,  viz.,  a  set  of  hierarchial  protection  domains 
called  protection  rings.  In  SASS,  there  are  two  domains 
implemented  (and  necessary  as  a  minimum):  the  Supervisor 
domain  and  the  Kernel  domain.  The  Z8001  microprocessor 
provides  the  SASS  with  two  execution  modes  that,  along  with 
Kernel  software,  implement  these  domains:  a  system  (Kernel) 
mode  that  provides  access  to  all  segments  (and  machine 
instructions),  and  a  normal  (Supervisor)  mode  that  provides 
access  to  a  subset  of  the  segments  (and  machine 
instructions).  Thus,  the  Supervisor  operates  in  the  outer  or 
less  privileged  domain. 

The  Supervisor  contains  those  segments  of  the  system 
that  are  necessary  to  perform  the  SASS  -  Host  computer 
system  interface  (construct  and  manage  a  file  hierarchy  and 
control  I/O  "between  the  SASS  -  Host).  It  is  built  upon  the 
Kernel  and  performs  the  Host's  requests  by  calls  to  the 
Kernel  (the  calls  are  validated  by  the  Gate  Keeper  prior  to 
invocation  of  Kernel  functions).  Two  surrogate  processes, 
input/output  (I/O)  and  file  management  (TM),  are  assigned  to 
each  Host  computer  system  at  system  generation.  The  FM 
process  directs  all  interaction  between  the  SASS  and  a  Host 
computer  system.  Specific  functions  include  the  management 
of  the  Host's  file  hierarchy  (using  the  FM  Known  Segment 
Table  (FM_KST)  as  a  database)   and  discretionary  security 
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access  management  (checking  and  maintaining  an  Access 
Control  List  (ACL)  for  each  file  within  the  file  hierarchy). 
Controlling  discretionary  security  with  an  ACL  allows 
authorized  users  to  specify  who  may  use  segments  (files) 
within  the  confines  of  the  non-discretionary  security 
policy.  Discretionary  security  will  "be  defined  and  discussed 
in  more  detail  in  chapter  II. 

The  I/O  process  acts  in  a  slave  mode  to  the  I'M 
process  and  is  responsible  for  all  input/output  "between  the 
Supervisor  and  the  host  computer  systems.  Data  is 
transferred  between  the  Host  and  the  SASS  via  fixed  size 
"packets"  (a  grouping  of  data  in  a  specified  format).  To 
transmit  and  receive  packets  "between  the  Host  and  the  SASS  a 
"protocol"  (or  formal  passing  method)  must  exist  "between 
them.  The  I/O  process  is  responsible  for  the  SASS-Host 
protocol  (Parks  [7]  designed  a  multi-packet  protocol).  Parks 
provides  a  detailed  description  of  the  Supervisor  as  it  was 
originally  designed. 

4.  Gate  Keeper  Module 

The  Gate  Keeper  is  a  software  ring-crossing 
mechanism  that  provides  for  the  isolation  of  the  Kernel 
(viz.,  making  the  Kernel  procedures  tamperproof ) .  The  notion 
of  a  "ring-crossing"  mechanism  is  an  extension  of  the 
previous  discussion  of  domains  since  "protection  rings"  is 
simply  another  term  for  hierarchial  domains  (such  as  the 
SASS  arrangement  of  the   Kernel   and   the   Supervisor).   All 
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calls  to  the  distributed  kernel  and  IPC  with  the  Memory 
Manager  must  pass  through  the  Gate  Keeper  (viz.,  it  is  the 
sole  entry  point  into  the  Kernel  from  the  Supervisor).  The 
Gate  Keeper  is  a  trap  handler?  when  invoked  by  the 
supervisor  domain  of  a  process,  it  must  save  the  supervisor 
domain  registers  and  stack  pointer.  The  argument  list 
provided  by  the  supervisor  domain's  call  (included  in  this 
list  must  he  the  identity  of  the  kernel  domain  function 
(procedure)  being  called)  is  validated  and,  if  correct, 
results  in  invocation  of  the  appropriate  procedure.  Hardware 
preempt  interrupts  are  masked  upon  entry  into  the  Kernel. 
When  returning  (exiting  the  Kernel)  the  following  actions 
occur:  (l.)  software  virtual  preempt  interrupts  are  unmasked 
(if  a  virtual  preempt  interrupt  has  occurred,  the  Traffic 
Controller's  virtual  interrupt  handler  is  called  •  vice  the 
Kernel  being  exited),  (2)  hardware  interrupts  are  unmasked, 

(3)  the  return  arguments  are  passed  to  the  Supervisor,   and 

(4)  the  Supervisor  domain  stack  pointer  and  registers  are 
restored,  returning  the  execution  point  to  the  Supervisor 
domain.  An  error  code  is  returned  and  the  Kernel  is  not 
invoked  when  an  invalid  call  is  encountered  by  the  Gate 
Keeper.  The  database  of  the  Gate  Keeper  is  the  Parameter 
Table.  This  table  contains  an  entry  for  each  permitted 
kernel  function  (e.g.,  Create_Segment,  Delete_Segment ,  etc.) 
and  is  used  to  validate  the  correctness  of  the  range  (size) 
of  the  parameters  passed. 
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5.   Level  One  -  Kernel 

Level  one  is  the  Security  Kernel  (or  Kernel).  The 
Security  Kernel  in  the  inner  or  most  privileged  domain 
(system  mode  of  the  Z8001)  and  is  responsible  for  managing 
the  real  resources  of  the  hardware  system  (viz.,  memory, 
microprocessor,  external  devices,  and  input/output  ports), 
and  for  enforcing  the  non-discretionary  security  policy  for 
the  SASS.  The  Kernel  is  divided  into  two  major  components. 
The  first  is  the  distributed  kernel,  i.e.,  the  modules  in 
the  Kernel  whose  segments  are  placed  in  (or  distributed  in) 
the  address  spaces  of  each  Supervisor  process;  the 
distributed  kernel  consists  of  the  Gate  Keeper  (already 
discussed),  the  Segment  Manager,  the  Event  Manager,  the 
Traffic  Controller,  and  the  Inner  Traffic  Controller.  The 
second  component  is  the  non-distributed  kernel  and  consists 
of  the  'asynchronous  memory  manager  process  (which  is 
contained  entirely  within  the  Kernel  address  space).  There 
is  a  memory  manager  process  for  each  hardware  processor  in 
the  SASS.  The  following  section  will  identify  and  briefly 
describe  each  of  the  Kernel's  distributed  and 
non-distributed  system  components, 
a.   Segment  Manager 

The  Segment  Manager  (the  focal  point  of  this 
thesis)  is  a  component  of  the  distributed  kernel?  its 
function  is  the  creation  and  management  of  a  segmented 
virtual  memory  for  the   process.   Actual   memory  management 
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functions  are  completed  via  calls  for  IPC  to  the  Memory 
Manager  process.  Calls  to  (viz.,  entries  into)  the  Segment 
Manager  are  received  via  the  Gate  Keeper  from  the 
Supervisor.  These  entries  (viz.,  extended  instructions)  are: 

1.  Create__Segment  —  add  a  new  segment  to  the  SASS. 

2.  Delete_Segment  —  remove  a  segment  from  the  SASS. 

3.  Make_Known  —  add  a  segment  to  a  process'  address 
space. 

4.  Terminate  —  remove  a  segment  from  a  process' 
address  space. 

5.  SM_Swap_In  —  move  a  segment  from  secondary- 
storage  to  main  memory. 

6.  SM_Swap_Out  —  move  a  segment  from  main  memory 
to  secondary  storage. 

The  process  local  database  used  by  the  Segment  Manager  is 
the  Known  Segment  Table  (KST).  The  KST  contains  entries  for 
all  segments  in  the  address  space  of  that  process.  The 
Segment  Manager  will  be  described  in  more  detail  in  chapters 
II  and  III. 

b.   Non-Discretionary  Security  Module 

The  Non-Discretionary  Security  (NES)  Module  is  a 
component  of  the  distributed  kernel;  its  function  is  the 
enforcement  of  the  non-discretionary  security  policy  in 
effect  in  the  SASS.  Although  the  implementation  presented  in 
this  thesis  reflects  the  DoD  non-discretionary  security 
policy,  any  security  policy  that  can  be   represented   by  a 
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lattice  structure  may  be  similarly  implemented.  To  implement 
a  different  policy  (e.g.,  Privacy  Act  or  a  local  policy) 
requires  only  replacement  of  the  Non-Discretionary  Security 
Module  (viz.,  the  modules  calling  it  can  he  left  intact  with 
no  changes  required  to  them).  The  NDS  Module  creates  the 
extended  instruction  set  CLASS_EQ  and  CLASS_GE.  The 
Non-Discretionary  Security  Module  and  the  information 
security  concepts  which  form  its  "basis  will  be  discussed  in 
more  detail  in  chapters  II  and  III. 
c.   Event  Manager 

The  Event  Manager  is  a  component  of  the 
distributed  kernel?  it  is  invoked  "by  the  Supervisor 
processes  via  the  Gate  Keeper.  This  module's  function  is  to 
manage  event  data.  Event  data  is  associated  with  a  global 
object  (called  an  eventcount).  An  eventcount  is  a  count  of 
the  number  of  events  (e.g.,  the  number  of  read  or  write 
accesses  of  a  segment)  that  have  occurred  so  far  in  the 
execution  of  a  system.  In  SASS,  as  a  naming  convention,  each 
Supervisor  segment  has  two  eventcounts  associated  with  it. 
These  eventcounts  (Instancel  and  Instance2)  are  stored  in  a 
Memory  Manager  database.  The  Event  Manager  creates  the 
extended  instruction  set  BEAD  and  TICKET;  they  are  based  on 
the  mechanism  of  eventcounts  and  sequencers  (used  for  the 
synchronization  of  concurrent  processes).  READ  is  a  call 
that  returns  the  current  value  of  the  eventcount.  TICKET, 
using  a   nondecreasing  integer  called  a   sequencer  (also 
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associated  with  each  Supervisor  segment),  provides  a 
complete  time  ordering  of  possibly  concurrent  events.  Each 
invocation  of  the  function  TICKET  increments  the  value  of 
the  sequencer  and  returns  it  to  the  caller.  The 
eventcounts/sequencer  synchronization  mechanism  is  described 
in  detail  by  Reed  and  Kanodia  [8]  while  an  excellent 
abridged  discussion  is  presented  by  Gary  and  Moore  [4] . 
d.   Traffic  Controller 

The  Traffic  Controller  (TC)  is  a  component  of 
the  distributed  kernel?  it  is  responsible  for  multiplexing 
processes  onto  virtual  processors.  A  virtual  processor  is  a 
data  structure  that  contains  a  complete  description  of  a 
process  in  execution  on  a  physical  processor  at  a  given 
instant.  A  "complete  description"  is  defined  to  consist  of 
the  execution  point  or  current  CPU  state  and  the  address 
space  (set  of  segments  accessible  by  that  process)  of  the 
process  in  execution.  The  Traffic  Controller  also  creates 
the  extended  instructions  ADVANCE  and  AWAIT  which  are  used 
to  implement  eventcounts  and  sequencers,  the  inter-process 
communication  (IPC)  mechanism  invoked  by  the  Supervisor,  and 
the  extended  instruction  PROCESS_CLASS.  PROCESS_CLASS  is 
invoked  by  the  Segment  Manager  and  returns  the  label 
(classification)  of  the  current  process.  The  Traffic 
Controller  is  half  of  a  two  level  traffic  controller;  the 
other  half  is  the  Inner  Traffic  Controller,  which 
multiplexes  the  virtual  processors  onto  physical  processors. 
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The  database  for  the  Traffic  Controller  is  the  Active 
Process  Table  (APT),  a  fixed  size,  system  wide  database, 
that  contains  a  permanent  entry  for  each  Supervisor  process 
created  at  system  generation  (in  the  SASS  the  processes  are 
then  active  for  the  life  of  the  system).  The  APT  structure 
is  shown  in  figure  2.  The  scheduling  algorithms  and  a 
detailed  discussion  of  the  current  state  of  the  Traffic 
Controller  are  provided  by  Reitz  [9]  . 
e.   Inner  Traffic  Controller 

The  Inner  Traffic  Controller  (ITC)  is  a 
component  of  the  distributed  kernel;  it  is  the  other  half  of 
the  two  level  traffic  controller  and  its  function  is  to 
multiplex  (temporarily  bind)  virtual  processors  (VP)  to  the 
real  processors  of  the  system;  a  design  choice  was  made  to 
provide  each  system  CPU  with  a  small  fixed  set  of  virtual 
processors.  Two  of  the  VP's  are  the  Memory  Manager  VP  and 
the  Idle  VP  (the  latter  is  permanently  bound  to  the  lowest 
priority  virtual  processor  and  is  scheduled  by  the  ITC  only 
when  there  is  no  useful  work  for  the  CPU) .  The  remaining 
VP's  have  Supervisor  processes  temporarily  bound  on  them  by 
the  Traffic  Controller.  Another  function  of  the  ITC  is  to 
furnish  inter-process  services  for  VP's  in  the  kernel  ring. 
This  is  done  by  providing  the  primitives  SIGNAL  and  WAIT, 
that  are  used  by  processes  in  the  Kernel  ring  to  communicate 
with  other  Kernel  ring  processes. 
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This  is  the  mechanism  used  within  the  Kernel  to  provide 
multiprogramming  (process  switching).  The  ITC  Module  creates 
the  extended  instruction  set:  SIGNAL,  WAIT,  SWAPJTDBR,  IDLE, 
SET_PREEMPT,  TEST_PREEMPT,  and  RUNNING_VP.  The  functions  of 
SIGNAL  and  WAIT  have  been  discussed  already.  SWAP_VDBR 
provides  the  TC  with  a  means  to  schedule  processes  on  the 
currently  running  VP.  IDLE  loads  an  "idle"  process  on  the 
currently  running  VP.  SET_PREEMPT  sets  the  virtual  preempt 
interrupt  flag  on  a  specified  VP  (specified  "by  the  TC ) . 
TEST_PREEMPT  provides  the  virtual  preempt  unmasking 
mechanism  that  is  executed  each  time  a  process  tries  to  move 
from  the  Kernel  to  the  Supervisor  domain.  The  database  used 
by  the  Inner  Traffic  Controller  is  the  Virtual  Processor 
Table  (VPT).  There  is  one  system  wide  table  with  entries  for 
each  physical  processor  in  the  system.  The  VPT  for  a  single 
processor  system  (such  as  SASS)  is  shown  in  figure  4.  The 
scheduling  algorithms  and  a  detailed  discussion  of  the 
current  state  of  the  Inner  Traffic  Controller  are  provided 
by  Reitz[9] . 

f.   Memory  Manager 

The  Memory  Manager  Module  is  the  only  component 
in  the  non-distributed  kernel.  There  is  a  Memory  Manager 
process  dedicated  to  each  physical  processor  (CPU)  in  the 
system. 
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The  Memory  Manager  is  responsible  for  managing 
the  real  memory  resources  of  the  system,  viz.,  local  and 
global  main  memory  and  secondary  storage.  The  memory  manager 
manages  the  local  and  global  memory  in  such  a  way  as  to 
control  bus  contention  in  the  multi-microprocessor 
environment.  Thus,  each  CPU  has  its  own  local  memory  to 
store  process  local  segments  and  there  is  a  global  memory  to 
which  every  CPU  has  access  and  in  which  shared,  writeable 
segments  must  be  stored.  This  requirement  is  to  ensure  that 
a  current  copy  is  always  accessed  for  a  shared,  writeable 
segment.  To  keep  bus  contention  between  processors  that 
access  global  memory  to  a  minimum,  whenever  possible  (viz., 
in  all  cases  but  shared,  writeable  segments)  segments  are  to 
be  stored  in  local  memory.  The  Memory  Manager  has  several 
databases,  primary  of  which  are  the  system  wide  Global 
Active  Segment  Table  (G_AST)  and  the  per  processor  local 
Active  Segment  Table  (L_AST).  A  more  detailed  description  of 
the  Memory  Manager  Module  is  presented  in  chapters  II  and 
III. 

6.   level  Zero  -  Hardware 

The  Z8001  microprocessor,  ZS010  Memory  Management 
Unit  (MMU),  local  and  global  memories,  and  secondary  storage 
form  the  SASS'  basic  hardware  group.  Since  the  design  calls 
for  SASS  to  exist  in  a  multi-microprocessor  environment, 
there  will  be  multiple  copies  of  some  elements  of  the  group, 
e.g., CPU,   local  memory.   The   Z8001  microprocessor   is  a 
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register  oriented  machine  that  has  sixteen  16-bit  general 
purpose  registers.  When  operated  with  the  MMU,  the  desired 
capabilities  of  memory  segmentation,  multiple  domains,  and 
process  switching  are  realized.  The  MMU  consists  of  a  set  of 
registers  (64)  to  implement  the  descriptor  list  (or 
descriptor  segment);  viz.,  each  register  contains  the 
descriptor  (containing  the  attributes)  of  a  particular 
segment.  Zilog  [14]  provides  a  detailed  description  of  the 
Z8001  microprocessor  and  Zilog  [15]  describes  the  Z8010  MMU. 

C.   STRUCTURE  0?  THE  THESIS 

This  thesis  describes  the  implementation  of  the  segment 
management  functions  for  the  SASS.  The  design  "base"  evolved 
from  the  original  secure  family  of  operating  systems 
identified  and  designed  by  O'Connell  and  Richardson.  A  block 
structured  language,  FLZ/STS,  was  used  in  this  and  previous 
design  efforts,  while  implementation  was  completed  using 
PLZ/ASM  assembly  code.  PLZ/STS  is  described  by  Snook  [12] 
and  Conway  [2]  while  PLZ/ASM  is  described  by  Zilog  [13] .  A 
compiler  for  PLZ/STS  to  PLZ/ASM  code  translation  was  not 
available.  As  a  result,  implementation  included  the  added 
step  of  manual  translation  of  PLZ/STS  code  to  PLZ/ASM  code 
to  facilitate  testing  and  debugging. 

In  this  chapter  an  introduction  to  SASS  was  provided 
through  discussion  of  its  background  and  an  overview  of  the 
entire  system.  A  summary  of  the  extended   instruction  sets 
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created  "by  the  Kernel  components  and  a  summary  of  the  Kernel 
databases  is  presented  in  figures  4  and  5. 

Chapter  II  of  this  thesis  will  present  a  description  of 
the  segment  management  functions  in  SASS.  Discussion  of  the 
theory  behind  information  security  and  its  implications  to 
SASS  is  also  provided.  The  modules  encompassed  by  segment 
management  will  be  discussed  in  terms  of  their  design, 
functional  purpose,  and  database  descriptions. 

Chapter  III  presents  the  implementation  of  segment 
management  (viz.,  the  segment  manager,  non-discretionary 
security,  and  distributed  memory  manager  modules). 
Description  of  design  and  implementation  criteria,  and 
choices  made  during  implementation  are  discussed  in  this 
chapter. 

Chapter  IV  provides  the  conclusions  reached,  status  of 
research,  and  recommendations  relative  to  continuation  and 
extension  of  the  work. 

Appendices  include  PLZ/ASM  code  for  the  modules,  the 
program  listings  for  the  Segment  Manager  demonstration  and  a 
summary  of  the  refinements  made  to  previous  design/code 
relative  to  SASS. 
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Figure  4.  Extended  Instruction  Sets 
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MODniE  DATABASE 
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Figure      5.      Kernel    Databases 
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II.  SEGMENT  MANAGEMENT  FUNCTIONS 

A  conceptual  discussion  of  the  functions  associated  with 
segment  management  is  presented  in  this  chapter.  As 
previously  mentioned,  two  dominating  goals  of  SASS  were  to 
provide  multilevel  controlled  access  to  information  and  to 
provide  for  controlled  sharing  of  information.  The  major 
factor  in  controlled  access  (which,  in  effect,  refers  to 
information  security)  and  in  information  sharing  is  the 
concept  of  segmentation.  Segmentation,  data  sharing,  and 
information  security  will  be  discussed  relative  to  their 
value  to  SASS. 

A.   BASIC  CONCEPTS/EISCUSSION 
1.   Segmentation 

Segmentation  has  previously  been  defined  as  the 
technique  for  managing  segments  of  an  address  space  where  a 
segment  is  defined  to  he  a  logical  grouping  of  information 
which  possesses  the  qualities  of  having  uniform  attributes, 
"being  logical  (vice  physical),  being  visible  to  the  user  and 
being  arbitrary  in  size.  Based  upon  this  notion,  a  process' 
address  space  is  then  viewed  as  consisting  of  the  collection 
of  segments  that  the  process  may  access.  In  a  segmented 
environment  all  addresses  require  two  components:  (l)  a 
segment  specifier  (number)  and  (2)  the  location  (offset) 
within   the   segment.   Each   segment  may  have  attached  to  it 
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logical  attributes  that  enable  certain  important  control 
features  to  be  implemented.  Controlled  access  and 
information  sharing  implementation  is  specifically- 
facilitated.  By  including  classification  and  access 
information  in  a  segment's  logical  attributes,  a  method  to 
enforce  information  security  is  provided.  Segmentation 
supports  information  sharing  since  it  allows  a  segment  to 
belong  to  more  than  one  address  space,  that  is,  a  single 
physical  copy  may  be  accessed  by  more  than  one  process. 
Controlled  physical  sharing  of  information  (within  access 
constraints)  is  achieved,  in  the  case  of  SASS,  by  putting 
segments  which  are  shared  and  writeable  into  the  system's 
global  memory  (vice  a  copy  in  each  local  memory). 

Segmentation  also  facilitates  the  implementation  of 
multiple  protection  domains  in  SASS.  A  process'  address 
space  is  divided  into  domains  or  arrangements  of  segment 
accessibility.  The  Kernel  domain  is  the  most  privileged  and 
includes  all  segments  of  the  address  space,  while  the 
supervisor  domain  is  less  privileged  and  excludes  segments 
representing  the  management  of  the  shared  resources  by  more 
than  one  process. 

2.   Data  Sharing 

The  facility  to  share  a  single  segment  (and  thus  a 
single  copy  of  the  information  to  be  accessed)  by  many 
processes  is  a  significant  feature  that  is  facilitated  via 
segmentation.   In   short,   by  processes   sharing  a   common 
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physical  copy  of  a  segment,  there  is  no  requirement  for 
duplicate  copies  and  thus  no  possibility  exists  of  having 
copies  that  are  not  up  to  date.  In  SASS,  given  the  global 
memory/local  memories  environment,  the  policy  is  to  put 
copies  of  segments  in  local  memory  except  in  the  case  of 
shared  and  writeable  segments,  which  are  placed  in  global 
memory  for  sharing  purposes  among  processes  with  the 
appropriate  access. 

Segmentation  is  vital  to  this  policy  since  only 
through  explicit  segmentation  can  SASS  know  the  read/write 
properties  of  the  information.  Thus,  segments  which  are 
shared  but  have  read  only  access  (by  all  processes  that  may 
access  it)  are  not  put  into  global  memory  but  rather  into 
the  local  memory  of  each  of  the  processes  that  may  access  it 
(viz.,  multiple  copies  exist).  There  is  no  possibility  of 
the  multiple  copy/  out  of  date  copy  problem  since  only  read 
access  is  allowed.  However,  this  is  a  seeming  waste  of 
memory  and  nonuse  of  the  sharing  facility  provided  by 
segmentation.  The  justification  is  based  on  a  design 
decision  motivated  by  another  goal  of  SASS  —  reduction  of 
bus  contention  among  processors  accessing  global  memory. 
This  is  considered  to  be  of  more  importance  than  the  saving 
of  memory  space  offered  by  single  copy  sharing  of 
information;  as  stated  before,  the  cost  of  memory  has  gone 
down  significantly  in  the  last  few  years  thus  reducing  its 
influence  on  decisions  such  as  this. 
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3.   Information  Security 

Information  security  in  a  computer  environment  only 
recently  began  to  receive  the  attention  that  it  deserves. 
Few  people  have  been  far  sighted  enough  to  view  computer 
security  in  an  analogous  manner  to  communications  security 
(an  area  which  has  received  considerable  military  and 
commercial  attention  throughout  history,  especially  since 
the  advent  of  electronic  communications).  Only  through  harsh 
and  embarrassing  lessons  has  the  importance  of  computer 
security  being  recognized.  The  range  of  problems  encountered 
covers  virtual  every  level  of  computer  usage:  banks  and 
commercial  enterprises  are  victims  of  theft  through  the 
felonious  use  of  computers;  universities  are  the  victims  of 
undesired  users  entering  their  systems  and  either 
maliciously  or  accidentally  destroying  valuable  programs? 
and  the  military  faces  the  real  possibility  that  classified 
material  is  being  accessed  by  foreign  agents  without  our 
knowledge  and/or  crucial  systems  are  being  tampered  with 
without  our  knowledge.  The  effects  of  these  type  actions  may 
be  as  small  as  simple  embarassment  or  as  serious  as 
undermined  military  preparedness.  It  should  be  clear  that 
information  security  is  a  serious  issue.  Definitively,  this 
thesis  will  consider  information  security  as  the  process  of 
providing  controlled  access  to  information  based  on  proper 
authorization.  A  pertinent  information  security  ?oal  is  to 
provide  a   "multilevel"   information   security  environment 
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(that  is,  an  environment  where  multiple  levels  of  sensitive 
information  and  user  access! bility  to  that  information  exist 
together  in  a  manner  such  that  security  is  not  compromised). 
The  key  to  achieving  computer  security  lies  with  the  concept 
of  the  "security  kernel".  A  discussion  of  this  concept  and 
some  supporting  definitions  is  provided  in  the  next  section. 
a.   Basic  Security  Principles 

The  protection  of  secure  information  in  computer 
systems  is  affected  through  two  types  of  control:  (1) 
external  controls  —  where  physical  means  are  used  to 
securely  isolate  the  computer  system  (e.g.,  an  armed  guard) 
and  (2)  internal  controls  —  where  the  computer  itself 
provides  protection  by  distinguishing  information  security 
levels  and  user  accesibilities  .  Although  the  discussion  in 
this  thesis  centers  around  internal  controls,  external 
controls  are  also  a  viable  and  important  aspect  of  the  SASS 
(and  other  computer  system's)  information  security.  As 
previously  stated,  the  key  (or  answer)  to  computer  security 
lies  in  the  security  kernel  concept.  Schell  [11]  provides  a 
detailed  development  of  the  theory  behind  this  concept.  The 
security  kernel  is  defined  as  that  part  of  the  computer 
system's  hardware  and  software  which  enforces  the  authorized 
access  relationships  between  the  user/process  (subject)  and 
the  accessed  information  (segment  or  object). 

An  important  aspect  to  the  development  of  a 
secure  kernel   based  system  is   the  security  policy  to  be 
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enforced.  There  are  two  distinct  aspects  of  security  policy. 
The  first  is  the  non-discretionary  (mandatory)  policy  that 
externally  constrains  what  access  is  permissable;  this 
policy  is  manifested  and  implemented  in  an  arrangement  where 
information  in  the  form  of  a  segment  (called  an  "object")  is 
labelled  as  to  its  sensitivity?  the  same  is  done  with  the 
party  requesting  access  (the  user/process,  called  a 
"subject").  The  relationship  between  the  subject  and  object 
"labels"  that  leads  to  an  access  permission  or  denial  is 
defined  by  a  lattice  structure  [3]  .  This  lattice  structure 
concept  will  be  discussed  in  the  next  section.  The  second 
aspect  of  security  policy  is  the  discretionary  policy,  which 
is  a  refinement  within  the  non-discretionary  constraints.  It 
is  emphasized  that  discretionary  security  is  contained 
within  (and  in  no  way  substitutes  for)  non-discretionary 
security.  An  example  is  the  "need  to  know"  policy  of  the 
DoD.  Implementation  of  the  discretionary  security  policy  for 
SASS  is  accomplished  in  the  Supervisor  through  the 
maintenance  of  an  Access  Control  List  (ACI)  for  each  file  in 
the  file  hierarchy.  Each  access  attempt  to  a  file  is  checked 
against  the  ACL  and  access  is  granted  in  accordance  with 
that  check  and  the  non-discretionary  security  check 
(whichever  granted  the  least  access).  This  allows  the  users 
to  specify  (subject  to  non-discretionary  security 
constraints)  who  may  access  their  files.  Since  the 
implementation  of  the  discretionary  security  policy  is  not  a 
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part  of  this  thesis,  a  detailed  discussion  is  not  provided. 
Parks  [7]  provides  a  discretionary  security  policy  design 
for  SASS. 

Implementation  of  a  security  policy  requires  an 
awareness  of  and  consideration  for  several  basic  security 
properties  which  are  briefly  defined  below. 

The  Simple  Security  Condition  restricts  a 
subject's  read  access  to  objects  whose  classification  is 
equal  to  or  less  than  than  the  subject's  classification  (the 
term  classification  will  hereafter  be  used  to  indicate  a 
degree  of  sensitivity  or  security  importance). 

The  Confinement  Property  (or  "^-property" ) 
restricts  a  subject's  write  access  to  objects  whose 
classification  is  equal  to  or  greater  than  the  subject's 
classification.  This  property  prevents  a  subject  from 
writing  to  an  object  of  lower  classification  where  another 
subject  (of  less  than  the  original  subject's  classification) 
would  have  potential  access  thus  violating  security. 

The  Compatibility  property  has  as  a  basis  the 
hierarchial  structure  of  the  objects  (segments)  of  SASS.  The 
objects  of  SASS  are  hierarchially  organized  in  a  tree 
structure.  The  structure  consists  of  nodes,  leaves,  and  a 
root  from  which  the  tree  eminates.  A  node  (an  alias  table 
that  contains  a  list  of  attributes  for  segments)  is  directly 
associated  with  a  segment  that  is  the  "mentor"  for  one  or 
more  segments.  A  leaf,  viz.,  a   segment,   is   not   an  alias 
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table  but  may  be  a  mentor  segment  (with  the  same  access 
class  as  the  alias  table).  The  Compatibility  property 
basically  states  that  the  object  access  classification  must 
be  non-decreasing  in  moving  from  the  root  down  the  hierarchy 
(viz.,  the  access  classification  of  a  child  must  be  greater 
than  or  equal  to  its  parent). 

b.   Lattice  Model:  Abstraction 

A  lattice  model  of  secure  information  flow 
concept  (discussed  by  Denning  [3] )  permits  concise 
formulations  of  the  security  requirements  of  different 
systems  and  facilitates  the  construction  of  mechanisms  that 
enforce   security.   Specifically,   the   relationship  between 

classifications  can  be  represented  by  a  partially  ordered 
lattice  structure  (examples  illustrating  this  concept  are 
presented  in  the  next  section).  Authorizations  for  access 
(or  decisions  on  compatibilty)  then  are  based  on  this 
lattice.  With  the  properties  previously  discussed  as  a 
basis,  the  accesses  permitted  are  defined  below  ("sac"  is 
the  abbreviation  for  "subject  access  classification"  and 
"oac"  for  "object  access  classification"  and  "'"  denotes 
"not  related"): 

1.  sac  ■  oac,  read/write  permitted 

2.  sac  >  oac,  read  permitted 

3.  sac  <  oac,  write  permitted 

4.  sac  !  oac,  no  access  permitted 
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Case  3  represents  a  subject's  ability  to  "write 
up",  which  is  a  capability  not  supported  in  SASS;  thus  for 
SASS,  case  3  is  more  accurately  represented  as: 

3.  sac  <  oac,  no  access  permitted 
At  this  point,  no  design  detail  has  been  provided  for  the 
representation  of  a  classification  or  for  defining  how  two 
classifications  are  compared  and  determined  to  be  "equal", 
"greater  than",  "less  than",  or  "unrelated"  (viz.,  what  does 
sac>oac  mean?).  The  next  section  will  illustrate  these  ideas 
both  generally  and  by  examples. 
c.   Examples 

Based  on  military  influence,  the  examples 
provided  are  reflective  of  a  subset  of  the  DoD 
non-discretionary  security  policy.  A  classification  (or 
label)  is  defined  to  have  two  parts:  (1)  a  level  (e.g.,  top 
secret,  secret,  confidential,  or  unclassified  in  the 
example)  and  a  category  (e.g.  Crypto  (Cy),  Nato  (N),  Nuclear 
(Nu),  or  empty  (%)  in  the  example).  In  the  actual 
implementation  (chapter  III),  provisions  will  be  made  for 
eight  levels  and  sixteen  categories.  (In  some  reference 
texts,  levels  are  called  categories  and  categories  are 
called  compartments).  The  levels  are  defined  ty  a  "totally 
ordered"  relationship  where  all  levels  are  related: 

Top  Secret  >  Secret  >  Confidential  >  Unclassified 

or 
TS  >  S  >  C  >  U 
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The  categories  are  defined  as  "disjoint"  (no  relationship 
exists  when  comparing  individual  categories  with  other 
individual  categories).  The  classifications  (labels)  (  the 
concatenation  of  level  with  category)  then  are  defined  to 
have  a  "partially  ordered"  relationship  since  some  hut  not 
all  classifications  are  related.  The  cases  to  he  illustrated 
will  he  illustrated  through  a  general  case  and  then  "by 
specific  examples.  The  general  structure  is  defined  hy: 

Subject's  classification  ■  (IS,  {CS}) 

Object's  classification  =  (10,  {CO}) 
where : 

LS  ■  Subject's  level 

{CS}  ■  Subject's  set  of  categories 

10  =  Object 's  level 

{CO}  =  Object's  set  of  categories 
The  non-inclusive  set  of  partially  ordered  examples  will  be 
chosen  from  a  subset  of  the  classifications  derivable  from 
the  set  of   totally  ordered  levels  and  the  set  of  disjoint 
categories : 

{TS,S,C,U}  and  {Cy,N,Nu,%} 

Case  I  :  Equal  (sac  =oac) 

General  -  IS  ■  10  and  {CS}  ■  {CO} 
Examples  -  (TS,{Cy,N})  =  (TS,{Cy,N}) 

-  (U,  {Cy}  )  =  (U  ,{Cy}  ) 
Access  -  Read/Write 
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Case  II:  Greater  than  (sac  >  oac) 

(1)  General  -  LS  >  LO  and  {CO}  subset  to  {CS} 
Examples  -  (S,{N,Nu}  )  >  (C,{N}  ) 

-  (S,{N,Nu}  )  >  (U,{%}  ) 

(2)  General  -  LS  >  10  and  {CS}  =  {CO} 
Examples  -  (TS,{%}  )  >  (S,{%}  ) 

-  (St  {Nu,N})  >  (U,{Nu,N}  ) 

(3)  General  -  IS  =  LO  and  {CO}  proper  subset  to  {CS} 
Examples  -  (U,  {Nu}  )  >  (Ut{%}  ) 

(TS,{Cy,N,Nu})  >  (TS,{Cy}  ) 
Access  -  Read 

Case  III:  Less  than  (sac  <  oac) 

(1)  General  -  LS  <  LO  and  {CS}  suhset  to  {CO} 
Examples  -  (S,  {%}  )  <  (TS,{N}  ) 

-  (U,  {N,Nu})  <  (C,  {Cy,N,Nu}) 

(2)  General  -  LS  <  LO  and  {CS}  =  {CO} 
Examples  -  (S,  {%}  )  <  (TS,{%}  ) 

-  (U,  {N.Nu})  <  (C,  {N,Nu}  ) 

(3)  General  -  LS  =  LO  and  {CS}  proper  sunset  to  {CO} 
Examples  -  (U,  {%}  )  <  (U,  {N}  ) 

-  (C,  {NfCy})  <  (C,{N,Nu,Cy}) 
Access  -  no  access  (in  SASS  ) 

■  Write  (in  principle) 

Case  IV  :  Unrelated  (sac  '  oac) 

(1)  General  -  LS  <»>,or  =  LO  and  {CS}  |  {CO} 

46 


Examples  -  (S,  {N}  )  j  (C,  {Nu}  ) 

-  (C  {Nu}  )  |  (S,  {M  }  ) 

-  (TS,{N}  )  !  (TS,{Cy}  ) 

(2)  General  -  IS  >  LO  and  {CS}  proper  subset  to  {CO} 
Examples  -  (TS,{%}  )  !  (S,  {N}  ) 

-  (C,  {N,Nu})  !  (U,{N,Nu,Cy}) 
Explanation  -  there  is  a  contradiction  "between 

the  relationship  of  the  levels  and 
the  relationship  of  the  categories. 
Since  this  contradiction  is 
unresolvable,  the  classification 
relationship  must  he  "unrelated". 

(3)  General  -  IS  <  LO  and  {CO}  proper  subset  to  {CS} 
Examples  -  (S,  {N,Nu}  )  |  (TS,  {N}) 

-  (U,  {Cy}  )  !  (C,  {%}) 
Explanation  -  same  as  above 
Access  =  No  access 
d.   Applications  to  the  SASS 

The  cases  above  are  designed  to  identify  each 
possible  relationship  that  exists  between  two  labels.  In  the 
SASS,  it  is  necessary  only  to  identify  cases  I  and  II  (label 
1  >*  label  2),  while  lumping  the  other  cases  into  a  single 
case  which  represents  "no  access".  This  arrangement 
encompasses  enforcement  of  the  Confinement  Property,  Simple 
Security  Condition,  and  the  Compatibility  property. 
Enforcement  must  occur  on  every  access  attempt  of  an -object. 
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A  discussion   of   the   implementation   of  non-discretionary 
security  policy  is  provided  in  the  next  chapter. 

B.   SEGMENT  MANAGER 
1.   Function 

The  Segment  Manager  is  the  focal  point  of  the 
segment  management  function.  Using  the  per-process  Known 
Segment  Table  as  its  database  and  the  Memory  Manager  and 
Non-Discretionary  Security  Module  in  strongly  supportive 
roles,  it  is  responsible  for  managing  the  segmented  virtual 
memory  for  a  process.  Its  role  can  he  viewed  as  somewhat 
intermediary  in  nature  (viz.,  between  the  Supervisor  modules 
and  the  Memory  Manager  modules).  The  extended  instruction 
'set  created  in  the  Segment  Manager  includes  the  following 
instructions:  CREATE_SEGMENT,  DELETE_SEGMENT,  MAKE_KNOWN , 
TERMINATE  ,  SM_SWAP_IN,  and  SM_SWAP_0tJT  (note  that  the  names 
for  SWAP_IN  and  SWAP_0UT  have  been  modified  by  preceding 
each  with  SM_;  this  is  strictly  for  clarity  because  the 
Memory  Manager  also  creates  two  instructions  called  SWAP_IN 
and  SWAP_OUT).  These  instructions  are  invoked  by  the 
Supervisor  domain  of  the  process  (viz.,  calls  are  made  from 
the  Supervisor  domain  via  the  Gatekeeper  to  the  Segment 
Manager  in  the  Kernel  domain)  to  provide  SASS  support  to  the 
Host. 

In  general,  when  the  Segment  Manager  receives  these 
calls,  it  performs  certain  checks  to  ensure  the  validity  and 
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security  compliance  (when  required)  of  the  request  (call). 
These  checks  are  performed  using  its  own  database  (the  KST) 
and  by  calls  to  the  Non-Discretionary  Security  Module  (when 
required).  The  Segment  Manager  invokes  one  of  six  Memory 
Manager  (more  specifically,  the  Distributed  Memory  Manager 
Module)  created  instructions.  These  instructions  include: 
MM_CKEATE_ENTRY,  MM_DELETE_ENTRY ,  MM_ACTIVATE, 
MMJDEACTIVATE,  MM_SWAP_IN,  and  MM_SWAP_OUT.  These  invoked 
instructions  (procedures)  in  turn  perform  interprocess 
communciations  with  the  non-distributed  memory  manager 
process  (where  actual  memory  management  functions  are 
accomplished).  These  interprocess  invocations  and  returns 
are  accomplished  through  the  use  of  the  IPC  primitives 
Signal  and  Wait.  The  Segment  Manager  returns  the  required 
arguments  to  the  Supervisor  by  value  (as  passed  back  to  it 
by  the  Memory  Manager  and/or  determined  within  itself).  The 
Segment  Manager  performs  actual  segment  number  assignment 
when  a  segment  is  made  known  to  a  process'  address  space.  It 
also  performs  any  further  database  (KST)  updating  as  may  be 
required.  A  more  detailed  description  of  the  specifics  of 
the  actions  of  the  Segment  Manager  will  be  provided  in  the 
implementation  described  in  Chapter  III. 
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2.   Database 

The  Known  Segment  Table  (KST)  is  the  database  used 
to  manage  segments.  The  KST  is  described  in  its  tabular  form 
and  PLZ/S^S  structured  representation  in  figure  6.  There  are 
several  basic  and  pertinent  facts  to  be  noted  of  the  KST: 

1.  It  is  a  process  local  database;  that  is,  each  process 
has  its  own  KST. 

2.  The  KST  is  indexed  by  segment  number;  each  record 

of  the  KST  consists  of  a  set  of  fields  (description 

i 

information)  regarding  a  particular  segment. 

3.  Entering  information  into  the  fields  of  a  segment 
is  called  "making  a  segment  known".  This  simply 
refers  to  adding  a  segment  to  a  process'  address 
space  (viz.,  making  a  segment  accessible  to  a 
process  ) . 

4.  In  SASS,  a  correspondence  exists  between  making  a 
segment  "known"  and  making  a  segment  "active";  i.e., 
when  a  segment  is  added  to  the  address  space  of 

a  process,  this  action  results  in  an  entry  in  the 
KST  (making  "known")  by  the  Segment  Manager  and  an 
entry  in  the  Global  Active  Segment  Table  (G_AS?) 
by  the  Memory  Manager  process  (making  it  "active"'). 
The  G_AST  will  be  described  later  in  this  chapter. 
A  proper  description  of  the  structure  and  fields  of  the  KST 
is  necessary  at  this  point.  Using  the  representation  of   the 
PLZ/SYS  language  structure,  the  KST  is  described  as  an  array 
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of  records  of  fields  of  varying  types.  The  fields  are 
described  separately  below.  Although  the  1ST  index  is  not  in 
itself  a  field  in  the  record,  it  does  perform  a  rather 
significant  role.  The  KST  index  is  an  integer  closely 
related  to  the  segment  number  of  the  segment  described  in 
that  KST  entry  (viz.,  it  is  the  subscript  into  the  array  of 
records).  This  segment  number  also  corresponds  to  the  MMU 
descriptor  register  (number)  for  that  segment. 

The  MM_Handle  is  the  first  field  in  a  KST  record. 
The  MM_Handle  is  a  system  wide  unique  number  that  is 
assigned  to  each  segment  with  an  entry  in  the  G_AST  (viz., 
every  active  segment).  This  "handle"  is  the  instrument  of 
controlled  single  copy  sharing  of  information  (segments).  It 
allows  a  segment  to  exist  under  one  unique  handle  but  be 
accessible  in  the  address  space  of  more  than  one  process 
(with  different  segment  numbers  in  each  address  space).  The 
MM_Handle  is  returned  to  the  Segment  Manager  by  the  Memory 
Manager  during  the  execution  of  the  Make_Known  instruction. 

The  Size  field  is  an  integer  value  (of  language 
structure  type  "word")  which  represents  the  number  of  256 
byte  blocks  composing  a  segment. 

The  Access_Mode  field  is  used  to  describe  the 
process'  access  to  the  segment  (i.e.,  null  or  read  and/or 
write) . 
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The  In_Core  field  is  used  to  indicate  if  the  segment 
is  or  is  not  in  main  memory  (i.e.,  this  field  is  a  flag  or 
true/false  boolean  switch). 

The  Class  field  is  a  long  word  field  used  to 
represent  the  degree  of  information  sensitivity  (viz., 
access  class)  assigned  to  the  segment.  This  field  (for 
example)  would  he  used  to  numerically  describe  a 
classification  label  (as  described  above). 

The  Mentor_Se£_Nr  field  is  a  number  representing  the 
segment  number  of  a  segment's  parent  or  "mentor"  segment. 
Its  importance  will  discussed  shortly. 

The  Entry_Nr  field  is  a  number  representing  a 
segment's  index  number  into  its  parent  or  mentor  segment's 
Alias  Table  (not  yet  discussed). 

The  Alias  Table  is  a  Memory  Manager  database  and 
will  be  described  later.  The  aliasing  scheme  provided  via 
the  alias  tables  is  used  to  prevent  passing  system  wide 
information  out  of  the  Kernel  (i.e.,  the  Unique_IE  of  a 
segment).  The  "alias"  of  a  segment  is  the  concatenation  of 
the  Mentor_Seg_Nr  with  the  segment's  Entry_Nr  (index)  into 
the  mentor  segment's  Alias  Table.  It  is  clear  that  the  last 
two  fields  of  a  KST  record  are  the  "alias"  of  that  segment. 
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Figure   6.      Known   Segment    Table 
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C.   NON-DISCRETIONARY  SECURITY  MOHTJIE 

The  key  in  protection  of  secure  information  usins 
internal  controls  was  identified  as  the  security  kernel 
concept.  The  "basic  idea  within  this  concept  is  to  prove  the 
hardware  part  of  the  Kernel  correct  and,  similarly,  to  keep 
the  software  part  small  enough  so  that  proving  it  correct  is 
feasible.  A  central  component  of  the  kernel  software'is  the 
Non-Discretionary  Security  Module  (hereafter  referred  to  as 
the  NDS  Module).  The  NTS  Module  is  concerned  only  with  the 
non-discretionary  aspect  of  the  security  policy  in  effect; 
since  the  discretionary  aspect  is  subservient  in  nature  to 
the  non-discretionary  aspect,  it  is  then  sufficient  that  the 
Kernel  contain  only  the  software  representing  the 
non-discretionary  aspect  of  the  security  policy.  The 
discretionary  security  is  provided  outside  the  kernel  in  the 
SASS  supervisor.  Every  attempt  to  access  information  must 
result  in  an  invocation  of  the  NDS  Module. 

The  function  of  the  NDS  Module   is   to   compare   two 

» 

classifications  (viz.,  compare  two  labels),  make  a  decision 
as  to  their  relationship  (i.e.,  =,>,<,!),  and  return  a 
true/false  interpretive  answer  relative  to  the  query  of  the 
calling  procedure.  The  mechanism  used  as  a  basis  is  the 
lattice  model  abstraction  previously  discussed.  The  NTS 
Module  does  not  require  a  database  since  the  labels  it 
compares  are  stored  in  (passed  from)  other  Kernel  databases. 
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D.   MEMORY  MANAGER 

1.   Function 

The  Memory  Manager  process  is  the  only  component  of 
the  non-distributed  kernel.  It  is  responsible  for  managing 
the  real  memory  resources  of  the  system  —  main  (local  and 
global)  memory  and  secondary  storage.  It  is  tasked  by  other 
processes  within  the  Kernel  domain  (via  Signal  and  Wait)  to 
perform  memory  management  functions.  This  thesis  will 
address  the  Memory  Manager  in  terms  of  two  components:  (1) 
the  Memory  Manager  Process  (also  called  the  nondistributed 
kernel  and  the  Memory  Manager  Module),  and  (2)  the 
distributed  Memory  Manager  (also  called  the  Distributed 
Memory  Manager  Module).  The  former  is  the  "true"  memory 
manager  while  the  latter  is  the  interface  with  other 
processes,  that  is,  it  resolves  the  issue  of  interprocess 
communication  with  the  "true"  memory  manager. 

The  Distributed  Memory  Manager  Module  creates  the 
following  extended  instruction  set:  MM_CREATE_ENTRT, 
MM_DELETE_ENTRY,  MM_ACTIVATE,  MM_DEACTIVATE,  MM_SVAP_IN,  and 
MM  SWAP  OUT.  The  instructions  form  the  mechanism  of 
communication  between  the  Segment  Manager  of  a  process  and  a 
memory  manager  process  (where  the  actual  memory  management 
functions  are  performed).  The  Memory  Manager  Process 
instruction  set  corresponds  one  to  one  with  that  of  the 
Distributed  Memory  Manager?  the  set  consists  of: 
CREATE_ENTR,»',   DELETE_ENTRY ,   ACTIVATE,  DEACTIVATE,  SWAP_IN, 
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and  SVAP_OUT.  The  basic  functions  performed  by  the  Memory 
manager  are  allocation/deallocation  of  global  and  local 
memory  and  of  secondary  storage,  and  segment  transfers  from 
local  to  global  memory  (and  vice-versa)  and  from  secondary 
storage  to  main  memory  (and  vice-versa). 
2.   Databases 

A  detailed  and  descriptive  discussion  of  the  Memory 
Manager  databases  is  presented  in  the  work  of  Gary  and  Moore 
[4]  and  the  reader  may  refer  to  it  for  memory  manager 
database  details.  This  thesis  addresses  the  implementation 
of  the  distributed  Memory  Manager  but  not  the  Memory  Manager 
Process,  thus  brief  descriptions  are  provided  of  the 
letter's  databases. 

The  Global  Active  Segment  Table  (G_AST)  is  a  system 
wide  (i.e.,  shared  by  all  memory  manager  processes)  database 
used  to  manage  all  active  segments.  A  lock/unlock  mechanism 
is  used  to  prevent  race  conditions  from  occurring.  The 
distributed  memory  manager  of  the  signalling  process  locks 
the  G_AST  before  it  signals  the  memory  manager  process. 

The  Local  Active  Segment  Table  (L_AST)  is  a 
processor  local  database  which  contains  an  entry  for  each 
segment  active  in  a  process  currently  loaded  in  local 
memory. 

The  Alias  Table  is  a  system  wide  database  associated 
with  each  nonleaf  segment  in  the  Kernel.  It  is  a  product  of 
the  aliasing  scheme  used   to   prevent   passing  system  wide 
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information  out  of  the  Kernel.  The  alias  table  header 
(provided  for  file  system  reconstruction  after  system 
crashes)  has  two  pointers,  one  linking  the  alias  table  to 
its  associated  segment,  the  other  linking  the  alias  table  to 
the  mentor  segment's  alias  table.  The  fields  in  the  alias 
table  are  Unique_ID,  Size,  Class,  Page_Table_Loc ,  and 
Alias_Table_Loc.  The  index  into  the  alias  table  is  Entry_No. 

The  Memory  Management  Unit  Image  (MMU_Image,  figure 
7)  is  a  processor  local  database  indexed  by  DBR_No  (viz., 
for  each  DBF._No  there  is  a  MMU_Image  record,  with  each 
record  containing  a  software  image  of  the  segment  descriptor 
registers  of  the  hardware  MMU).  The  MMU_Image  is  an  exact 
image  of  the  MMU.  Each  record  is  indexed  by  Segment_No 
(segment  number)  and  each  Segment_No  entry  contains  three 
fields.  The  Base_Addr  field  contains  the  segment's  base 
address  in  memory.  The  Limit  field  contains  the  number  of 
blocks  of  contiguous  storage  for  the  segment  (zero  indicates 
one  block).  The  Attributes  field  contains  8  flags  including 
5  which  relate  to  the  memory  manager.  The  Elks_Used  field 
and  the  Max_Blks  (available)  fields  are  per  record  (not  per 
segment  entry)  and  are  used  in  the  management  of  each 
process'  virtual  core. 

The  Memory  Bit  Maps  (Disk_Bi t_Map, 
Global_Memory_Bit_Map,  and  Local_Memory_Bi t_Map)  are  memory 
block  usage  maps  that  use  true/false  flags  (bits)  to 
indicate  the  use  or  availability  of  storage  blocks. 
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The  only  database  in  the  Distributed  Memory  Manager 
is  the  Memory  Manager  CPU  Table.  It  is  an  array  of  memory 
manager  ?P_ID's  (MM_VP_ID)  indexed  by  CPU  number.  This  table 
enables  a   signalling  process   to  identify  the  appropriate 

memory  manager  process  (virtual  processor)  to  signal. 

i 

E.   SUMMARY 

The  segment  management  functions  and  key  related 
concepts  (such  as  segmentation)  were  discussed  in  this 
chapter.  The  importance  of  segmentation  to  data  sharing  and 
information  security  was  emphasized  as  were  key  information 
security  concepts.  With  this  background,  the  implementation 
of  segment  management  and  a  non-discretionary  security 
policy  will  be  described  in  Chapter  III. 
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III.   SEGMENT  MANAGEMENT  t IMPLEMENTATION 

The  implementation  of  segment  management  functions  and  a 
non-discretionary  security  policy  is  presented  in  this 
chapter.  Paramount  to  this  implementation  were  several  key 
issues  that  affected  the  implementation.  These  issues  are 
discussed  first.  The  implementation  is  discussed  in  terms  of 
the  Segment  Manager,  Non-Discretionary  Security  (NDS),  and 
Distributed  Memory  Manager  modules. 

A.   IMPLEMENTATION  ISSUES 

Segment  management  for  the  SASS  was  provided  through  the 

implementation  of  the  Segment  Manager  Module,  the  NDS 
Module,  and  the  Distributed  Memory  Manager  Module. 
Additionally,  since  a  demonstration/testbed  was  integral  to 
the  testing  and  verification  of  the  implementation,  it  was 
necessary  to  complete  other  supportive  tasks.  Reitz  [9] 
provided  a  demonstration  of  the  operation  of  the  Inner 
Traffic  Controller  primitives  SIGNAL  and  WAIT  (for 
interprocess  communication).  Integral  to  this  demonstration 
was  the  correct  performance  of  the  Inner  Traffic  Controller 
VP  scheduling  mechanism  and  a  "stub"  of  the  Traffic 
Controller  and  its  process  scheduling  mechanism  (the  TC 
support  and  use  of  the  mechanism  of  eventcounts  and 
sequencers  was  not  a  part  of  the  demonstration).  The  Segment, 
management   demonstration   (hereafter   referred   to   as 
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"SegJIgr.Demo" )  was  ""built  on  top  of"  F.eitz'  ITC 
synchronization  primitive  demonstration  (hereafter  referred 
to  as  "Sync.  Demo").  Thus,  an  immediate  issue  was  to  resolve 
the  feasibility  of  adding  on  to  Sync. Demo  and  also  to  refine 
the  present  design  of  the  Sync.  Demo  to  facilitate  its 
integration  into  the  Seg_Mgr.Demo .  One  aspect  of  this  effort 
was  in  resolving  the  problem  of  how  to  pass  (i.e.,  in 
interprocess  communication)  a  larger  message. 
1.   Interprocess  Messages 

The  Sync. Demo  passed  "word"  (16  "bit)  messages.  To 
provide  the  mechanism  for  the  distributed  memory  manager  to 
signal  the  memory  manager  process  with  a  command  function 
identification  code  and  the  arguments  needed  to  perform  that 
function  (e.g.,  CREATE-ENT5Y  and  its  input  arguments),  a 
message  size  .of  at  least  eight  words  (16  bytes)  was 
necessary.  An  obvious  answer  was  to  signal  with  an  array  of 
eight  words  as  the  message.  PLZ/SYS,  however,  does  not  allow 
passing  arrays  in  its  procedure  calls  (a  procedure  call  is 
analogous  to  a  subroutine  call).  Another  alternative  was  to 
signal  with  a  pointer  to  the  array  of  words,  since  PLZ/STS 
does  allow  passing  pointers  in  procedure  calls  (thus  the 
message  would  be  a  pointer  to  the  real  message).  This, 
however,  would  be  invalid  in  the  segmented  implementation 
(on  the  Z8000  segmented  microprocessor)  since  identical 
segment  numbers  in  different  processes  may  not  refer  to 
identical  segments.  For  example,   a   pointer   in  a   process 
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(e.g.*  file  management)  points  to  an  array  (i.e.,  provides 
its  address)  by  segment  number  and  offset;  passing  this 
pointer  to  another  process  (e.g.,  memory  manager)  would 
provide  this  same  segment  number  and  offset  which,  of 
course,  may  he  a  different  object  in  the  second  process's 
address  space). 

Another  alternative  considered  was  that  of  a  shared 
"Mailbox"  segment  with  an  associated  eventcount  acted  on  by 
the  Kernel  Inner  Traffic  Controller  primitives 
TICKET, ADVANCE  and  AWAIT.  A  design  for  using  this  concept  in 
the  supervisor  ring  is  provided  by  Parks  [7] .  This 
alternative  was  not  deeply  considered  since  these  primitives 
are  not  included  in  the  current  Inner  Traffic  Controller. 

The  method  ultimately  used  to  signal  the  new  length 
messages  is  based  on  the  fact  that  the  ITC  is  in  both  the 
signalling  and  the  receiving  (memory  manager)  processes' 
address  space.  The  message  is  loaded  into  an  array  in 
process  #1  and  a  pointer  to  the  array  is  passed  in  the  call 
SIGNAL?  the  VPT,  the  ITC's  database,  is  then  updated  by 
(using  the  pointer)  putting  the  message  into  its  MSG_Q 
section.  The  message  is  retrieved  by  process  #2  by  execution 
of  Reitz'  WAIT  primitive  with  only  one  refinement.  That 
refinement  is  for  the  "waiting"  process  to  provide  as  an 
argument  (in  the  WAIT  primitive)  a  pointer  to  its  own 
message  array  so  that  the  message  in  the  VPT  can  be  copied 
to  it. 
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This   refinement    provides   for   passing-  a   long  message 
essentially  "by  value"  between  processes. 

2.  Structures  as  Arguments 

Another  issue  concerned  the  use  of  pointers  in  the 
implementation  of  segment  management.  This  necessary  "evil" 
is  a  result  of  the  need  to  pass  linguistically  "complex" 
data  types  in  procedure  calls.  Complex  types  refer  to  array 
and  record  structures  in  PLZ/SYS  (as  opposed  to  the  "simple" 
types — byte,  word,  integer,  short-integer,  long,  and 
pointer).  In  managing  databases  (e.g.,  KST,  G_AST)  which 
consist  of  arrays  of  records  (which  in  turn  contain  records 
and/or  arrays),  it  was  frequently  necessary  to  reference 
data  as  an  array  or  record.  Within  a  process,  the  use  of 
pointers  was  not  a  problem  (i.e.,  not  a  problem  such  as 
would  be  encountered  in  IPC  passing  of  pointers). 

3.  Reentrant  Code 

The  issue  of  code  reentrancy  was  addressed  at  the 
assembly  language  level  through  the  use  of  a  stack:  segment 
and  registers  for  storage  of  local  variables.  PIZ/STS  (high 
level  language)  does  not  address  reentrant  procedures  and 
thus  the  segment  management  high  level  code  is  not 
automatically  reentrant.  The  problem  of  reentrancy  can  be 
seen  by  looking  at  a  shared  procedure  that  is  not  reentrant; 
such  a  procedure  has  storage  for  its  variables  allocated 
statically  in  memory.  Suppose  a  procedure  (e.g.,  in  the 
Kernel)  can  be  activated  by  more  than  one  process.  While  the 
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procedure  is  executing  in  one  process,  a  process  switch 
occurs  (e.*.,  to  wait  for  a  disk  transfer)  and  its  execution 
is  suspended.  The  second  process  is  activated,  and  while  it 
is  running  it  invokes  the  procedure.  While  the  procedure  is 
executing  for  the  second  process  it  uses  the  same  storage 
space  for  variables  as  it  did  when  executing  for  the  first 
process.  Eventually,  it  relinquishes  the  processor.  However, 
when  the  procedure  resumes  its  execution  for  the  first 
process,  the  variable  values  that  were  in  use  by  it 
originally  have  been  changed  during  its  execution  in  the 
second  process.  Thus,  incorrect  results  are  now  inevitable. 

4.  Process  Structure  of  the  Memory  Manager 
References  to  the  "Memory  Manager"   in   past   works 

have  generally  meant  the  memory  manager  process 
(non-distributed  kernel).  This  work  references  two  distinct 
components  of  the  "memory  manager  module".  The  Distributed 
Memory  Manager  is  an  interface  provided  to  the  Memory 
Manager  Process.  It  is,  in  fact,  distributed  in  the  address 
space  of  each  Supervisor  process.  In  contrast,  the  Memory 
Manager  Process  clearly  is  not  distributed  and  its  address 
space  is  contained  entirely  in  the  Kernel. 

5.  Per-Process  Known  Segment  Table 
Another  key  issue  was   that   of   the   per   process 

Segment  Manager  database,  the  KST.  Since  each  process  has 
its  own  1ST,  it  cannot  be  linked  to  the  (shared)  segment 
manager  procedures.   To   implement  the  KST  as  a  per  process 
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database,  it  was  convenient  to  establish,  by  convention,  a 
EST  segment  number  that  is  consistent  from  process  to 
process.  That  segment  in  each  process  is  the  KST  segment  for 
that  process.  Implementation  is  then  accomplished  by  using 
the  segment  number  to  construct  a  pointer  to  the  base  of  the 
appropriate  KST.  It  is  then  easy  to  calculate  an  appropriate 
offset  to  index  any  desired  entry  in  the  KST  data. 
6.   DBR  Handle 

In  Reitz's  implementation  of  the  multilevel 
scheduler  and  the  IPC  primitives,  references  to  "DBR" 
(descriptor  base  register)  are  references  to  an  address. 
That  address  value  represents  a  pointer  to  an  MMU_IMAGE 
record  containing  the  list  of  descriptors  for  segments  in 
the  process  address  space.  Gary  and  Moore  [4]  reference  a 
"DBR_NO"  that  is  essentially  a  handle  used  within  the  memory 
manager  as  an  index  within  the  MMU_IMAGE  to  a  particular  MMU 
record.  The  base  address  of  the  MMU  record  indexed  by  E£?._N0 
is  then  "  equivalent  to  the  concept  of  DBR  value  used  in 
Reitz'  work.  The  effect  of  this  inconsistency  on  the  segment 
management  implementation  was  minor  and  will  be  further 
discussed  later  in  this  chapter. 

B.   SEGMENT  MANAGER  MOEULE 

The  Segment  Manager  Module  consists  of  six  procedures 

representing  the   six  extended   instructions   it  provides. 

These   are   based   on   the  design  of  Coleman  [l] .  Only  calls 
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from  external  to  the  Kernel  (via  the  Gate  Keeper)  may  he 
made  to  the  Segment  Manager  (per  the  loop-free  structure  of 
-the  SASS).  The  normal  sequence  of  invocation  of  the  Segment 
Manager  functions  to  allow  referencing  a  segment  is:  (1) 
CREATE_SEGMENT — allocate  secondary  storage  for  the  segment 
and  update  the  mentor  segment's  Alias  Tahle ,  (2) 
flAKE_KNOWN — add  the  segment  to  the  process  address  space 
(segment  number  is  assigned),  (3)  SWAP_IN — move  the  segment 
from  secondary  storage  into  the  process's  main  memory.  The 
normal  sequence  of  invocation  to  "undo"  the  ahove  is:  (1) 
SWAP_0UT — move  the  segment  from  main  memory  to  secondary 
storage,  (2)  TERMINATE — remove  the  segment  from  the 
process's  address  space,  (3)  DELETE_SEGMENT — deallocate 
secondary  storage  and  remove  the  appropriate  entry  from  the 
alias  tahle  of  its  mentor  segment.  The  six  Supervisor 
entries  into  the  Segment  Manager  (viz.,  the  six  extended 
instructions)  will  he  discussed  individually  helow.  The 
PIZ/STS  and  PLZ/ASM  listings  for  the  Segment  Manager  are  in 
appendices  A  and  B. 

1.  Create  a  Segment 

The  function  that  creates  a  segment  (i.e.,  adds  a 
new  segment  to  the  SASS)  is  CREATE_SEGMENT.  This  function 
validates  the  correctness  of  the  Supervisor  call  by  checking 
the  parameters  and  making  certain  security  checks.  The 
distributed  memory  manager  is  then  called  to  accomplish 
interprocess  communication  with  the  Memory  Manager  Process, 
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where  segment  creation  is  realized  through  secondary  storage 
allocation  and  alias  table  updating. 

CREATE_SEGMENT  is  passed  as  arguments:  (1) 
Mentor_Seg_No — the  segment  number  of  the  mentor  segment  of 
the  segment  to  be  created,  (2)  Entry_No — the  desired  entry 
number  in  the  alias  table  of  the  mentor  segment,  (3) 
Class — the  access  class  (label)  of  the  segment  to  be 
created,  and  (4)  Size — the  desired  size  of  the  segment  (in 
blocks  of  256  bytes).  The  initial  check  is  to  verify  that 
the  desired  size  does  not  exceed  the  designed  maximum 
segment  size.  If  this  check  is  satisfactory,  a  conversion  of 
the  Mentor_Seg_No  to  a  KST  index  is  necessary.  This  is 
because  the  Kernel  segments  use  the  first  several  segment 
numbers  available  but  do  not  have  entries  in  the  KST.  Thus 
if  there  were  10  Kernel  segments  and  a  system  segment  had 
segment  number  15,  then  its  index  in  the  KST  would  actually 
be  5  (i.e., the  Kernel  segments  would  use  numbers  0-9,  and 
this  segment  would  be  the  sixth  segment  in  the  KST  and  its 
index  would  be  5).  A  call  is  then  made  to  the  procedure 
ITC_GET_SEG_PTR  with  the  constant  KST_SEG_N0  passed  as  a 
parameter.  This  procedure  will  return  a  pointer  to  the  base 
of  this  process'  KST.  This  pointer  is  then  the  basis  for 
addressing  entries  in  the  KST.  The  next  check  is  to  see  if 
the  mentor  segment  is  known  (viz.,  is  in  the  address  space 
of  the  process,  and  thus,  in  the  KST).  The  key  to 
determining  if  any   segment  is  known  is  the  mentor  segment 
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entry  (M_SEG_No)  for  that  segment  in  the  EST.  If  not  known, 
this  entry  in  the  segment's  KST  record  will  he  filled  with 
the  constant  NTJLL_SEG.  The  "basis  for  checking  to  see  if  the 
segment's  mentor  segment  is  known  is  the  aliasing  scheme 
implication  that  a  mentor  segment  must  he  known  before  a 
segment  can  be  created.  The  process  classification  must  next 
he  obtained  from  the  Traffic  Controller.  The  process 
classification  is  checked  to  ensure  that  it  is  equal  to  the 
classification  of  the  mentor  segment  since  write  access  to 
its  alias  table  is  needed  to  create  a  segment.  The  NDS 
module's  CLASS_EQ  procedure  is  called  and  returns  a  code  of 
true  or  false.  The  last  check  is  the  compatibility  check  to 
ensure  that  the  classification  of  the  segment  to  be  created 
is  greater  than  or  equal  to  the  classification  of  the  mentor 
segment.  This  is  accomplished  by  calling  the  NDS  Module's 
CLASS_GE  procedure  which  returns  a  code  of  true  or  false.  If 
any  of  these  checks  are  unsatisfactory,  an  appropriate  error 
code  is  generated  and  the  Segment  Manager  returns  to  its 
calling  point.  If  all  checks  are  satisfactory,  then  a 
pointer  to  the  mentor  segment's  MM_Handle  array  is  derived 
(HPTR).  Note  that  in  the  current  memory  manager  design  [4] 
the  actual  MM_Handle  contents  are  a  Unique_IE  (a  Ions  word, 
viz.,  two  words  concatenated),  and  an  Index_No  (index  into 
the  G_AST,  a  word);  thus  together  these  two  fields  are  a 
total  of  three  words.  Since  the  Segment  Manager  does  not 
interpret   this   handle,  it  is  considered  a  three  word  array 
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at  this  level.  For  this  reason,  the  entire  uninterpreted 
MM_Handle  array  will  be  passed  by  passing  its  pointer.  This 
pointer  and  Entry_No,  Size,  and  Class  are  then  passed  in  a 
call  to  the  distributed  memory  manager  procedure 
MM_CREATE_ENTRT.  This  procedure,  in  turn,  performs  IPC  with 
the  memory  manager  process  where  segment  creation  ultimately 
is  accomplished.  A  success  code  is  returned  in  an  IPC 
message  from  the  memory  manager  process  via  the  distributed 
memory  manager  to  the  CREATE_SEGMENT  procedure  to  indicate 
success  or  failure  as  appropriate.  This  success  code  is 
checked  by  the  Segment  Manager  to  ensure  confinement  would 
not  be  violated  if  it  is  returned  to  the  calling  process' 
supervisor  domain.  Only  after  the  success  code  has  been 
returned  can  the  action  of  segment  creation  be  considered 
complete.  Segment  creation  does  not  imply  the  ability  to 
reference  that  segment;  MAKE_KNOWN  will  accomplish  that. 
2.  Delete  a  Segment 

The  function  that  deletes  a  segment  (i.e.,  deletes  a 
segment  from  SASS)  is  DELETE_SEGMENT.  Validation  of 
parameters  and  security  checks  are  performed  here  similar  to 
(but  fewer  than)  the  CREATE_SEGMENT  checks.  The  distributed 
memory  manager  is  then  called  to  cause  IPC  with  the  memory 
manager  process,  where  segment  deletion  is  realized  through 
secondary  storage  deallocation  and  alias  table  entry 
deletions.  DELETE_SEGMENT  is  passed  as  arguments:  (1) 
Mentor_Seg_No   and    (2)   Entry_No.    Conversion   of   the 
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Mentor_Seg_No  to  a  KST  index  is  accomplished  first.  The 
pointer  to  the  case  of  the  KST  is  located  and  returned,  as 
before.  The  mentor  segment  is  checked  to  ensure  it  is  known, 
again,  by  verifying  that  its  own  M_SEG_No  (mentor  segment 
number)  entry  in  the  KST  is  not  the  NULL_SEG.  The  process 
classification  is  obtained  from  the  TC  and  checked  (by  a 
call  to  CLASS_EQ)  to  ensure  it  is  equal  to  the  mentor 
segment  classification,  since  deleting  an  entry  requires 
write  access  to  the  alias  table.  If  all  checks  are 
satisfactory,  then  the  mentor  segment's  MM_Handle  pointer  is 
derived.  This  pointer  and  the  mentor  segment  alias  table 
entry  number  are  passed  in  a  call  to  the  distributed  menory 
manager  procedure  MM_DELETE_ENT"RY.  It  then  performs  IPC  with 
the  memory  manager  process  where  segment  deletion  is 
accomplished  and  a  success  code  is  returned  as  before. 
3.   Make  a  Segment  Known 

The  function  that  makes  a  segment  known  (i.e.,  adds 
that  segment  to  the  process'  address  space  by  assigning  a 
segment  number,  updating  the  KST,  and  causing  the  memory 
manager  process  to  "activate"  the  sesrment  (that  is,  add  it 
to  the  AST  ))  is  MAKE_KNOWN.  Making  a  segment  known  is  the 
way  the  Supervisor  declares  its  intention  to  use  a  segment. 
MAKE_KNOWN  is  passed  as  arguments:  (1)  Mentor_Seg_No ,  (2) 
Entry_No,  and  (3)  Acess_Desired  (e.g.,  write,  read,  or 
null).  It  returns  (1)  a  success  code,  (2)  the  access  allowed 
to  the  segment,  and  (3)  the  segment  number.   Conversion   of 

70 


the  mentor  segment  number  to  a  EST  indext  finding  the  KST 
pointer,  and  verifying  that  the  mentor  segment  is  known 
occur  as  previously  discussed. 

There  are  three  basic  cases  that  may  occur  in 
MAKE_KNOWN:  (1)  the  segment  is  already  known  (has  an  entry 
in  the  KST),  (2)  the  segment  is  not  known  and  there  is  a 
segment  number  available,  or  (3)  the  segment  is  not  known 
and  there  is  no  segment  number  available. 

A  search  is  made  of  the  KST  using  each  record's 
(segment's)  M_SEG_No  (mentor  segment  number)  and 
Entry__Number  fields  as  the  search  key.  If  these  two  fields 
match  the  input  values  Mentor_Seg_No  and  Entry_No,  then  the 
record  indexed  is  that  of  the  desired  segment;  thus  the 
segment  to  be  made  known  is  already  known.  In  this  case,  all 
that  need  be  done  is  to  return  the  success  code,  segment 
number  (converted  from  the  index  by  adding  to  it  the  number 
of  kernel  segments),  and  the  access  allowed  (equal  to  the 
Access_Mode  entry  in  the  KST  for  the  already  known  segment). 

During  the  search  of  the  KST,  the  M_SEG_No  field  is 
also  checked  to  see  if  it  contains  the  NULL_SEG  entry  (this 
implies  that  the  segment  number  associated  with  the  record 
is  "available").  The  first  time  this  is  noted,  the  index  is 
saved.  Note  the  first  available  index  is  saved  since  it  is 
desired  to  assign  segment  numbers  at  the  "top"  of  the  KST  to 
keep  it  dense  there.  When  the  search  does  not  find  that  the 
segment   is  already  known,   the   index  for   the  available 
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segment  number  is  retrieved  and  converted  to  segment  number 
by  adding  to  it  the  number  of  kernel  segments.  If  this  index 
is  the  NUIL_SEG  entry,  then  there  is  no  segment  number 
available.  In  this  event,  the  success  code  is  set  to 
NO_SEG_AVAIL,  the  segment  number  is  assigned  NULL_SEG,  and 
access  allowed  is  set  to  NtJLLJLCCESS  (this  is  the  third  case 
mentioned).  If  the  index  is  not  equal  to  NTJLL_SEG  and 
conversion  to  segment  number  has  occurred  then  the  Traffic 
Controller  is  called  to  provide  the  DBR_No  (descriptor  base 
register  number)  for  the  current  process.  The  DER_No  is  used 
by  the  memory  manager  process  as  an  index  in  the  MMU_Image 
and  the  local  AST.  The  distributed  memory  manager  procedure 
MM_Activate  is  called?  it  is  passed  the  EBR  number,  the 
pointer  to  the  mentor  segment's  MM_Handle  entry,  the  mentor 
segment  alias  table  Entry_No,  and  the  -segment  number. 
MM_Activate  performs  the  normal  interface  function  (performs 
IPC  with  the  memory  manager  process  procedure  that  updates 
the  local  and  global  AST's)  and  also  updates  the  KST  entry 
for  the  new  segment's  MM_Handle  entry  (returned  from  the 
memory  manager  process).  It  also  returns  to  the  Segment 
Manager  the  success  code,  the  segment  classification,  and 
the  segment  size  from  the  memory  manager  process.  If  the 
success  code  is  "succeeded"  then  the  issue  of  access  to  be 
granted  must  be  resolved.  The  process  classification  is 
obtained  from  the  TC  and  passed  with  the  segment 
classification  to  the  NDS  Module  procedure  CIASS_GE.  If  the 
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CONDITION_CODE  returned  is  FALSE  then  access  allowed  is 
NULL_ACCESS,  the  segment  number  is  NULL_SEG,  and 
MM_DEACTIVATE  is  called  to  deactivate  the  segment.  An 
appropriate  error  code  is  returned.  If  it  is  greater  than  or 
equal  then  the  access  allowed  is  assigned  as  follows:  (1 ) 
the  two  classifications  are  compared  again — this  time  to  see 
if  equal;  (2)  If  they  are  equal,  then  the  access  allowed  is 
either  read  or  write  per  the  access  desired;  (3)  if  they  are 
not  equal  (i.e.,  the  process  class  is  greater  than  the 
segment  class)  then  the  access  allowed  is  read.  Finally  the 
1ST  entries  for  that  segment  number  (more  accurately  for  its 
index  in  the  KST)  are  filled  with  the  appropriate 
information  (e.g.,  IN_C0EE  is  false,  etc.).  If  the  success 
code  returned  from  the  memory  manager  process  via  the 
distributed  memory  manager  is  not  "succeeded",  then  the 
segment  number  is  set  to  NULL_SEG  and  the  access  allowed  is 
set  to  NULL_ACCESS. 

4.   Make  a  Segment  Unknown  (Terminate) 

The  function  that  makes  a  segment  unknown  (i.e., 
removes  that  segment  from  the  process'  address  space — by 
updating  the  KST  and  causing  the  memory  manager  process  to 
"deactivate"  the  segment)  is  TERMINATE.  It  results  in 
removal  of  the  M_SEG_No  (mentor  segment  number)  entry  from 
that  segment's  KST  record.  Terminate  is  passed  the  segment 
number  of  the  segment  to  be  terminated  as  an  argument.  It 
returns  a  success  code.  Conversion  of  the  segment  number  to 
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a  KST  index,  finding  the  KST  pointer,  and  verifying  that  the 
segment  is  known  occurs  in  the  same  manner  as  previously 
discussed.  The  next  check  is  to  verify  that  the  segment  is 
not  still  loaded  in  the  process'  virtual  core  (viz.,  it  has 
been  "swapped-out") .  If  not,  an  error  code  is  returned  and 
the  user  must  cause  the  Segment  Manager  extended  instruction 
SM_SWAP_OUT  to  he  executed.  The  next  check  is  to  ensure  that 
the  user  is  not  attempting  to  terminate  a  Kernel  segment. 
The  first  several  segment  numbers  in  a  process'  address 
space  will  he  used  by  Kernel  procedures  and  data  (though 
they  will  not  he  entries  in  the  KST).  Thus  if  there  were  10 
Kernel  segments,  then  the  segment  number  to  he  terminated 
must  he  greater  than  or  equal  to  #10  (since  the  Kernel 
segments  used  # 's  0-9).  Thus  a  check  is  made  to  ensure  that 
the  segment  number  is  not  less  than  the  number  of  Kernel 
segments?  otherwise  an  error  code  is  returned.  Next,  the 
segment  number  is  checked  to  ensure  that  it  is  not  larger 
than  the  maximum  segment  number  allowable  (if  so,  an  error 
code  is  returned).  If  all  checks  are  satisfactory,  then  the 
segment's  MM_Handle  pointer  and  the  process  DBR_No  are 
obtained  (as  discussed  before)  and  passed  in  a  call  to  the 
MM__Deactivate  procedure.  It  calls  the  memory  manager  process 
procedure  DEACTIVATE  which  removes  or  updates  (as 
appropriate)  the  entries  in  the  local  and  global  AST's. 
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5.   Swap  a  Segment  In 

The  function  that  swaps  a  segment  from  secondary 
storage  to  main  memory  (global  or  local)  is  SM_SWAP_IN.  It 
is  passed  the  segment  number  of  the  segment  to  be  swapped  in 
as  an  argument  and  returns  a  success  code.  Conversion  of  the 
segment  number  to  a  KST  index,  finding  the  KST  pointer,  and 
verifying  that  the  segment  number  is  known  are  accomplished 
as  previously  discussed.  If  the  check  is  satisfactory,  then 
the  segment's  MM_Handle  pointer  and  the  process  EBE  number 
are  obtained.  They  are  passed  with  the  segment's  access  mode 
(from  the  KST)  as  arguments  in  the  call  to  MM_SWAP_IN.  It 
performs  normal  interface  (IPC)  functions  and  returns  a 
success  code  from  the  memory  manager  process'  SWAP_IN 
procedure  (where,  if  not  already  in  core,  allocation  of  main 
memory  space  and  reading  the  segment  into  main  memory 
occurs).  If  the  success  code  is  "succeeded"  then  the 
segment's  IN_CORE  entry  in  the  KST  is  updated  to  show  that 
the  segment  is  in  main  memory  for  this  process  (i.e.,  the 
entry  is  now  "true"). 

>6.  Swap  a  Segment  Out 
The  function  that  swaps  a  segment  from  main  memory 
to  secondary  storage  is  SM_SWAP_OUT.  It  is  passed  the 
segment  number  of  the  segment  to  be  swapped  out  as  an 
argument  and  returns  a  success  code.  The  behavior  of 
SM_SWAP_OUT  is  exactly  analogous  to  that  of  SM_Sw"AP_IN 
except   that   the   segment's  KST  IN_C0RE  entry  is  updated  to 
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reflect  that  the  segment  has  been  removed  from  main  memory 
for  this  process  (I.e.,  the  new  entry  is  "false"). 

C.   NON-DISCRETIONARY  SECURITY  MODULE 

The  Non-Discretionary  Security  Module  implements  the 
non-discretionary  security  policy  for  the  SASS.  The  NDS 
module  contains  two  procedures:  CLASS_EQ  and  CLASS  JJE;  "both 
compare  two  labels  (classifications)  and  determine  if  their 
relationship  meets  that  of  the  procedure's  name  (i.e., 
equal,  or  greater  than  or  equal).  Although  the  type  of 
checks  being  made  are,  in  fact,  compatibility  checks.  Simple 
Security  Condition  checks,  etc,  the  NDS  Module  does  not 
recognize  or  need  to  recognize  this.  It  simply  uses  an 
algorithm  to  determine  if  classification  #1  =  classification 
#2  or  if  classification  #1  >=  classification  #2,  as 
appropriate.  It  then  returns  a  condition  code  of  true  or 
false  in  accordance  with  the  particular  case.  The  earlier 
discussion  of  label  comparison  in  accordance  with  a 
partially  ordered  lattice  structure  is  relevant  in 
discussing  the  NDS  Module's  algorithm.  Consider  the  same 
"totally  ordered"  relationship  TS  >  S  >  C  >  U  of  levels  and 
the  "disjoint"  relationship  Cy  i  N  }  Nu  !  %  of  categories. 
Comparison  of  levels  will  be  numerical  comparisons  while 
comparison  of  categories  will  use  set  theory  comparison  as  a 
basis.  If  TS=4,  S=3,  C=2,  U=l  are  level  numerical 
assignments,    then   the   totally  ordered   relationship   is 
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maintained  (i.e.,  TS>S>OU  is  still  true).  Now  consider  the 
categories  and  mate  the  following  assignments :  Cy=l ,  N=2, 
Nu=4,  %=0.  Note  that  a  classification  may  have  only  one 
level  and  one  category  set  (the  category  set  may  contain 
several  categories).  Consider  this  example:  (TS,{CytN}.  The 
level  is  TS  (=4).  The  category  is  the  set  {Cy,N}  and 
numerically  is  formed  by  performing  a  logical  OR  with  the 
categories  Cy  and  N.  Sixteen  hit  representation  of  this  is: 
Cy  OR  N 

(0000  0000  0000  0001)  OR  (0000  0000  0000  0010) 
=  0000  0000  0000  0011  =  {Cy,N} 

If   (TS,{Cy,N})   is  considered  label  #1  and  (S,{N})  as  label 
#2  then  a  comparison  of  the  two  labels  would  be: 

(1)  Compare  level  #1  with  level  #2  —  4  >  3? 
Clearly,  the  answer  is  yes. 

(2)  Compare  category  #1  with  category  #2  —  is 
(0000  0000  000£  0011)  a  superset  of 

(0000  0000  0000  0010),  or  more  clearly 

is  the  latter  a  subset  of  the  former? 

The  answer  is  yes,  and  one  way  to  show  that  is  true  is 
by  performing  a  logical  OR  of  category  #1  with  category  #2 
and  comparing  the  result  to  category  #1.  If  the  result  of 
the  OR  operation  equals  category  #1  then  category  #1  is  a 
superset  (not  necessarily  proper)  of  category  #2.  Since 
usage  of  the  term  subset  is  more  frequent  than  that  of 
superset,  this  relationship  will   typically  be   stated   as 
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category  #2  is  a  subset  of  category  #1.  To  illustrate  the 
above: 

{Cy,N}  OR  {N}  : 

(0000  00|00  0000  0011)  OR  (0000  0000  0000  0010) 
=  0000  0000  0000  0011  =  category  #1. 

This  means  that,  in  this  example,  that  category  #2 
is  a  subset  (not  necessarily  proper)  of  category  #1.  Since 
level  #1  >  level  #2  and  category  #2  subset  category  #1  then 
label  #1  >  label  #2.  Thus,  a  call  to  the  CLASS_Eq  procedure 
with  these  two  labels  as  the  input  classifications  would 
return  a  condition  code  of  false  while  CLASS_GE  would  return 
true.  The  decision  to  have  the  classifications  as  Ion?  word 
(32  bits)  supports  the  requirement  of  some  EoD 
specifications  for  eight  levels  and  sixteen  categories.  This 
module  uses  sixteen  bits  for  the  level  and  sixteen  bits  for 
the  category.  Appendices  3  and  F  are  the  PLZ/STS  and  PLZ/ASM 
listings  for  the  NDS  Module. 

1.  Equal  Classification  Check 
The  CLASS_EQ  procedure  performs   comparison   of   two 

classifications  (labels)  and  returns  a  condition  code  of 
true  if  they  are  equal  (an  exact  match  of  the  two  long  words 
bit  per  bit)  or  false  if  they  are  not. 

2.  Greater  or  Equal  Classification  Check 
The  CLASS_GE  procedure  performs   comparison   of   two 

classifications  (labels)  and  returns  a  conditi on . code  true 
if  classification  #1   is  greater   than   or   equal   to 
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classification  #2  or  a  condition  code  of  false  otherwise. 
For  classification  #1  to  be  greater  than  or  equal  to 
classification  #2,  the  following  must  he  true:  (1)  level  #1 
>=  level  #2  (determine  this  by  simple  numerical  comparison 
of  values)  and  (2)  category  #2  subset  category  #1  (determine 
this  by  performing  a  logical  OR  with  the  categories  and 
comparing  the  result  to  category  #1  —  if  they  are  equal 
then  category  #2  is  a  subset  of  category  #1). 

Since  PLZ/SYS  allows  passing  only  "simple"  types  in 
calls,  the  labels  were  passed  as  long  words  (as  opposed  to 
each  being  word  arrays  of  length  two).  An  access  class  label 
is  never  interpreted  outside  the  NDS  Module.  However,  within 
the  NDS  Module  it  is  necessary  to  address  the 
classification's  components  separately  (viz.,  level  and 
category).  Thus,  an  "overlay"  of  the  logical  view  of  the 
classification  was  created.  This  overlay  was  a  record  of 
type  ACCESS_CLASS  and  it  consisted  of  two  fields:  level  — 
16  bit  integer  and  category  —  16  bit  integer.  A  pointer 
type  CPTR  was  declared  to  be  of  type  pointer  to 
ACCESS_CLASS.  Two  other  pointers  CLASS1_PTR  and  CLASS2_PTR 
were  declared  to  be  of  type  CPTR  and  were  set  equal  to  the 
base  address  of  CLASS1  and  CLASS2  respectively.  This 
"overlay"  of  the  record  frame  over  the  two  classification 
labels  passed  as  arguments  allowed  the  desired  component 
addressibility. 
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Futhermore,   the  non-discretionary  policy  enforced  by  SASS 
can  be  changed  from   the   current   DoD  policy   to   another 
lattice  policy  by  changing  (only)  the  NDS  Module. 
D.   DISTRIBUTED  MEMORY  MANAGER  MODULE 

The  Distributed  Memory  Manager  Module  performs  as  an 
interface  between  the  Segment  Manager  and  the  Memory  Manager 
Process.  As  its  name  implies,  it  is  distributed  in  the 
kernel  domain  of  each  Supervisor  process.  The  key  role 
performed  in  this  module  is  to  arrange  and  perform 
interprocess  communication  between  its  process  (actually  the 
VP)  and  the  memory  manager  process  (VP).  The  module  consists 
of  eight  procedures.  Six  of  the  procedures  are  called 
directly  by  Segment  Manager  procedures?  they  are 
MM_CREATE_ENTRY,  MM  J)ELETE_ENTRT t  MM_ACTIVATE, 
MMJJEACTIVATE,  MM_SWAP_IN,  and  MM_S¥AP_0UT.  The  other  two 
procedures  are  "service"  procedures  called  by  multiple 
procedures;  they  are:  MM_GET_DBR_VA1UE  and  PERFORM_IPC.  The 
logic  used  in  the  first  six  procedures  is  somewhat  uniform 
(except  for  MM_ACTIVATE) .  Thus,  the  general  logic  will  be 
explained  (with  MM_CREATE_ENTR7  as  an  example)  and  it  should 
suffice  as  a  description  for  all  (except  MM_ACTIVATE) 
procedures.  The  service  procedures  will  be  described 
separately. 

1.   Description  of  Procedures 

Each  procedure  is  invoked  (and  returns)  on  a  one  to 
one  basis  with  a   corresponding  procedure   in   the  Segment 
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Manager.  For  example,  CREATE_SEGMENT  invokes  MM_CREATE_ENTRY 
which  signals  the  CREATE_ENTRY  procedure  in  the  Memory 
Manager  Process  Module.  Associated  with  each  procedure  is  an 
IPC  message  "frame"  to  describe  the  unique  format  of  the 
contents  of  the  message  to  "be  signalled  to  the  memory 
manager  process.  Similarly,  there  must  he  a  message  "frame" 
for  return  messages  from  the  memory  manager  process?  this 
frame  is  the  same  for  all  "but  the  MM_ACTIVATE  procedure. 
Consider  the  message  frame  for  MM_CREATE_ENTRYJ  it  consists 
of:  (1)  a  code  to  describe  which  function  is  to  he  performed 
(e.g.,  CREATE_CODE  indicates  that  the  CREATE_ENTRY  procedure 
is  the  intended  recipient  of  the  message),  (2)  MM_Handle  (an 
array  of  three  words),  (3)  Entry_No,  (4)  Size,  and  (5) 
Class.  The  message  frame  has  a  filler  (in  this  case)  of  one 
byte  to  ensure  that  it  is  of  length  16  bytes.  The  purpose  of 
this  frame  is  to  provide  an  overlay  onto  the  actual  message 
array  to  be  signalled  and  to  facilitate  loading  the 
arguments  into  the  message  array.  This  is  accomplished  by 
having  a  pointer  of  the  type  that  points  to  the  frame  but  by 
converting  its  address  so  that  it  actually  points  to  the 
base  of  the  message  array.  Consider  these  lines  of  PIZ/SYS 
code : 

CE_MSGPTR  :=  CE_PTR  COM_MSGPTR 
CE_MSGPTR~.CREATE_CODE  :=  CREATE_ENTRY_CODE 
This   code   is  putting  a  value  into  the  structure  pointed  to 
by  CE_MSGPTR  at  entry  CREATE_CODE.  The  key  point  is  that  the 
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frame  of  that  structure  is,  in  fact,  CREATE_MSG  (as 
described  before),  but  the  physical  location  pointed  to  is 
the  message  array.  This  is  assured  by  bavin*  the  pointer 
CE_MSGPTR  (which  points  to  a  structure  of  type  CREATE_MSG) 
set  equal  to  a  pointer  (C0MJ1SGPTR)  to  the  actual  message 
array  (COM_MSGBUE) .  This  is  accomplished  by  the  first  line 
of  code.  The  message  array  itself  is  never  directly 
referenced,  but  rather  the  message  array  that  is  overlayed 
by  the  message  frame  is  filled  in  the  format  of  the 
CREATE_MSG  frame.  In  this  example,  the  first  two  bytes  of 
the  message  array  now  contain  the  value  of  the  constant 
CREATE_ENTRr_CODE.  The  remainder  of  the  message  array  is 
filled  in  the  same  manner  (all  procedures  use  the  same 
notion  of  a  frame,  although  the  frames  have  different 
formats).  The  PEREORM_IPC  (perform  interprocess 
communication)  procedure  is  called  by  all  procedures  at  this 
point  in  their  execution.  The  key  is  that  the  argument 
passed  is  the  message  array  pointer  not  the  pointer  to  the 
CREATE_MSG  record  (after  all  it  is  only  an  overlay  frame  — 
linguistically,  it  is  only  a  type  and  is  never  declared  as  a 
structure  requiring  memory  storage  allocation).  When 
PERFORM_IPC  returns,  the  message  array  contains  a  return 
message.  This  message  consists  of  only  a  success  code  and 
filler  space  in  all  cases  but  MM_ACTIVATE.  Interpretation  of 
the  return  message  is  performed  in  the  same  manner  as 
loading  the  message  array.  The   retrieved   success   code   is 
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returned  to  the  calling  Segment  Manager  procedure.  For 
MMJLCTIVATE,  the  return  message  must  be  Interpreted  and 
values  for  success  code,  segment  size,  and  segment 
classification  retrieved  and  returned  to  the  Segment  Manager 
MAIE_KNOWN  procedure.  The  value  for  the  MM_Handle  (called 
the  G_AST_Handle  by  the  memory  manager  process)  must  be 
retrieved  and  entered  in  the  KST  record  for  this  segment. 
2.   Interprocess  Communication 

The  final  arrangements  and  actual  performance  of  IPC 
is  completed  by  the  internal  procedure  PEEFOPM_IPC.  Ey 
locating  the  identity  of  the  current  physical  processor 
(CPU)  and  using  that  identity  to  index  into  the 
MM_CPO*_TABLE ,  the  VP_ID  of  the  current  memory  manager  is 
resolved,  so  that  the  memory  manager  process  dedicated  to 
this  physical  processor  is  signalled.  The  call  to  K_L0CK  is, 
in  fact,  a  disguised  call  to  the  SPIN_L0CI  procedure  (since 
|k_L0CK  calls  SPIN_L0CE).  K_L0CK  represents  an  ultimate  (as 
yet  unimplemented)  goal  of  a  Kernel  locking  (wait-lock) 
system.  In  any  event,  the  G_AST  lock  must  be  set  prior  to 
signalling  the  memory  manager  process.  After  SIGNAL  has  been 
called,  a  call  is  made  to  WAIT  with  the  pointer  to  the 
message  array  as  the  argument.  The  synchronization  cycle 
that  results  is:  (1)  PERFORM_IPC  calls  the  ITC  procedure 
SIGNAL  with  the  memory  manager  VP_ID  and  message  array 
pointer  as  arguments;  PEPF03M_IPC  then  calls  WAIT  with  the 
message  array  as  the  argument,  (2)  SIGNAL  causes  the  message 
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array  to  be  copied  into  the  message  queue  (in  the  VPT)  of 
the  appropriate  VP_ID,  (3)  ultimately,  the  signalled  VP  is 
scheduled?  it  had  previously  called  WAIT,  passing  a  pointer 
to  its  own  local  message  array?  the  action  of  WAIT  is  to 
copy  the  message  from  the  VPT  to  the  signalled'  process 
local  message  array?  there  it  is  interpreted  by  the  memory 
manager  process  main  procedure  and  the  appropriate  procedure 
is  called  for  action  (e.g.,  CREATE_ENTRY) .  (4)  when  action 
is  completed  the  memory  manager  process  fills  its  local 
message  array  with  the  appropriate  return  message  and  calls 
SIGNAL  with  a  pointer  to  the  message  and  the  original 
signalling  process's  VP_ID  as  arguments,  (5)  SIGNAL  causes 
the  memory  manager  process'  message  to  he  copied  into  the 
VPT  message  queue  for  the  appropriate  VP_ID,  (6)  that  VP  is 
eventually  scheduled  and  through  the  action  of  WAIT  has  the 
return  message  copied  from  its  message  queue  in  the  VPT  to 
its  local  message  array?  WAIT  then  returns  to  PERFORM_IPC. 
The  G_AST  lock  is  unlocked  and  PERFORM_IPC  returns  to  the 
appropriate  distributed  memory  manager  procedure. 

The  last  procedure  in  the  distributed  memory  manager 
is  MM_GET_DBR_VALUE.  This  procedure  simply  provides  the 
service  of  translating  a  DBR_N0  (DER  number)  into  its 
appropriate  DBR  address.  It  is  called  by  the  TC_GETWORK 
procedure  to  allow  it  to  call  the  ITC  procedure  SWAP_VDER 
(remember  that  presently  the  Inner  Traffic  Controller  deals 
with  the  DER  as  the  address  of  the  appropriate  MMU  record  in 
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the  MMU_IMAGE  while  the  Traffic  Controller  uses  DBR  as  a  DBR 
number  which  indexes  to  the  appropriate  MMU  record). 

5.  SUMMARY 

The  implementation  of  segment  management  functions  and  a 
non-discretionary  security  policy  for  the  SASS  has  been 
presented  in  this  chapter.  The  implementation  of  the  Segment 
Manager  Module,  Non-Discretionary  Security  Module,  and 
Distributed  Memory  Manager  management  demonstration  was 
described. 

Chapter  IV  will  present  the  conclusions,  lessons 
learned,  and  suggestions  for  future  work  derived  from  this 
thesis. 
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IV.   CONCLUSIONS  AND  FOLLOW  ON  WORK 


The  implementation  of  segment  management  for  the 
security  kernel  of  a  secure  archival  storage  system  has  been 
presented.  The  implementation  was  completed  on  Zilog's  Z8002 
sixteen  "bit  nonsegmented  microprocessor.  Segmentation 
hardware  (Zilog's  Z6010  Memory  Management  Unit)  was  not 
available,  therefore  it  was  simulated  in  software  as 
described  by  Reitz  [9].  The  loop  free  modular  construction 
used  in  the  implementation  facilitates  ease  of  expansion  or 
modification . 

A  non-discretionary  security  policy  was  implemented 
using-  a  partially  ordered  lattice  structure  as  a  basis. 
Enforcement  was  realized  through  an  algorithm  tnat  compared 
two  labels  and  determined  if  their  relationship  was  equal  to 
a  desired  relationship.  Although  the  DoL  security 
classification  system  was  represented,  any  non-discretionary 
security  policy  that  may  be  represented  by  a  lattice 
structure  may  similarly  be  implemented.  This  implementation 
nas  shown  that  by  having  the  non-discretionary  security 
policy  enforced  in  one  module,  changing  to  another  policy 
requires  changing  only  this  one  module. 

Software  engineering  techniques  used  in  previous  work 
emphasized  the  advantages  of  working  with  code  that  is  well 
structured,   well   documented,   and   well  organized.  Cespite 
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being  written  in  assembly  language,  Reitz'  implementation  of 
multiprogramming  and  process  management  proved  to  be 
consistent  in  style,  clarity  and  documentation.  This 
enhanced  the  construction  of  a  segment  management 
demonstration  which  was  built  onto  his  synchronization 
demonstration.  Further,  refinements  made  to  nis  code  (not 
necessitated  "by  any  failures  of  his  code)  were  relatively 
easily  accomplished. 

While  the  segment  management  implementation  appears  to 
perform  properly,  it  has  not  teen  subjected  to  a  formal  test 
plan.  Such  a  test  plan  should  be  developed  and  implemented. 

The  Memory  Manager  Process  has  teen  designed  tut  not 
implemented.  Segment  management  implementation,  provision 
for  IPC  usin?  more  practical  size  messages,  and  the  detailed 
design  of  the  memory  manager  by  Moore  and  Gary  [4] ,  provide 
a  sound  foundation  for  memory  manager  implementation.  A 
framework  of  the  mainline  code  needed  is  provided  in  the 
memory  manager  module  of  the  demonstration  code  in  Appendix 
I.  Prior  to  this  implementation,  formal  testing  of  the 
segment  management  implementation  herein  and  the  monitor 
implemented  by  "Reitz  [9]  should  be  completed. 
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APPENDIX   A    -    SEGMENT    MANAGER    PLZ/SYS    LISTINGS 
SEGMENT    MANAGER  MODULE 


CONSTANT 


TYPE 


NULL_ACCESS 
NULL  SEG 

MAX    NO    KST    ENTRIES 
MAX_SEG_SIZE 
MAX_5EG_N0 
KST    SEG    NO  • 

NR_OF_KSEGS 
FALSE 
TRUE 
READ 

WRITE 


SUCCESS    COD 

SUCCEEDED 


ES 


MENTOR  SEG  NOT  KNOWN 

:  = 

22 

ACCESS  CLASS  NOT  EO   : 

= 

33 

NOT  COMPATIBLE 

;  = 

24 

SEGMENT  TOO  LARGS     : 

•  = 

25 

NO  SEG  AVAIL 

>  = 

27 

SEGMENT  NOT  KNOWN 

;  = 

x'S 

SEGMENT  IN  CORE 

:  = 

29 

KERNEL  SEGMENT 

:  = 

32 

INVALID  SEGMENT  NC 

;  = 

31 

NO  ACCESS  PERMITTED   : 

!  = 

32 

LEAE  SEG  EXISTS 

;  = 

10 

NC  LEAF  EXISTS 

;  = 

11 

ALIAS  DOSS  NOT  EXIST 

;  = 

23 

NO  CHILD  TO  DELETE    : 

= 

22 

G  AST  FULL 

:  = 

12 

L  AST  FULL           : 

= 

13 

LOCAL  MEMORY  EULL     : 

:  = 

16 

GLCEAL  MEMORY  EULL 

;  = 

17 

SEC  STOR  FULL 

;  = 

21 

PROC_CLASS_NOT_GE_SEG. 

.c: 

LASS 

F_ARRAY      ARRAY  [  3 

KST  REC     RECORD  [  I 

1M 

.HAN 

4 

-1 

?? 

?? 

?? 

?? 

?? 

2 

1 

1 

Z 


—    o 


!TO 
!TC 
!TO 
!TO 
!TO 


BE 
BE 
BE 
BE 
BE 


:  =   41 


WORD  ] 


determined: 
determined! 

DETERMINED! 
DETERMINED! 
DETERMINED! 


£S' 


ARRAY 


MM  HANDLE 

H  ARRAY 

SIZE 

WORD 

ACCESS  MODE 

BYTE 

IN  CORE 

BYTE 

CLASS 

■LONG 

M  SEG  NC 

SHORT  INTEGER 

ENTRY_ NUMBER 

SHORT_ INTEGER 

MAX  NO  KST  ENT 

RIES  IZST  REC  ] 

120 


KSTPTR  KST 

ADDRESS  WORD 

SEG..ARRAY  ARRAY    [MAX_SEG_S  IZE        BYTE] 

EXTERNAL 

CLASS_EQ   PROCEDURE 

RETURNS       (    CONDITION. CCDE      BYTE    ) 

CLASS _GE   PROCEDURE 

RETURNS       (    CONDITION. CODE      BYTE    ) 

MM   CREATE   EN THI   PROCEDURE 

RETURNS       (    SUCCESS_CODE      BITE    ) 

MM  DELETE  ENTRY  PROCEDURE 

RETURNS   {  SUCCESS. CODE   BYTE  ) 

MM_MA£E_KNOWN  PROCEDURE 

RETURNS   (  SUCCSSS_CODE  BYTE 

CLASS  LCNG 

SIZE  WORD  ) 

MM_TSRMINATE  PROCEDURE 

RETURNS   (  SUCCESS.  CODE   BYTE  ) 

MM  SWAP  IN  PROCEDURE 

RETURNS   (  SUCCESS. CODE   3YTE  ) 

MM  SWA?  CUT  PROCEDURE 

RETURNS   (  SUCCESS_CODE   BYTE  ) 

TC_GET_?ROC_CLASS  PROCEDURE 

RETURNS   (  PROC_ CLASS   LONG  } 

ITC.GST  SEG_?TR  PROCEDURE 

RETURNS   (  SEGPTR   ~SEG_  ARRAY  ) 

MCNITCR   PROCEDURE 

!TO  BE  IMPLEMENTED  AT  ASSEMBLY  LEVEL  -  SIMPLY  WILL 
CALL  TEE  MONITOR  AT  ADDRESS  &259A! 

INTERNAL 

HPTR    ~H_ARRAY 
KPTR    ESTPTR 
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GLOBAL 

f  *,*  ?|»  5»*  ifi  *fi  ~fi  5»*  i*  »»*  \*  5|»  ?i*  J|*  *P  5,J  i4i  #f»  J,»  *,»  J,c  i,*  5,i  ,,c  5jC  ,t»  ;,c  5,i  5,C  »,S  -,c  *,c  ;,£  5,£  ;,£  ;,*  ;,c  ;,;  ^i  *£  ;,;  ;,i  ;,s  ^  ^i  ;Ji  ;tc  ;,£  ;tc  ;(c  5,C  ;,C  i,i  5,S  ifi  5,s  ?,?  J^i  ;,c 

*  CREATE   SEGMENT  PROCEDURE.    INVOKED   BY  SUPEEYISOE  * 

*  PROCEDURE   VIA    GATE   KEEPER.    ENSURES    CALL    IS    VALID  * 

*  BY   CHECKING    TC    SEE    IE   MENTOR   SEGMENT   KNOWN,    IF  * 

*  SEGMENT    SIZE    IS    TOO    LARGS    (DESIGNED    MAX    SIZE),    IE  * 

*  ACCESS    CLASSIFICATION    ARE   EQUAL, AND    I?    COMPATIBILITY    * 

*  REQUIREMENTS    MET.    IF    ALL    CHECKS    ARE    SATISFACTORY  * 

*  THEN    MM   CREATE_ENTRY    IS    CALLED   FOR    MEMORY  MANAGER  * 

*  TO   TAKE    ACTION.  * 

V  *i*  i»  -»»  *v  ni*  "i*  "r  «•»*  *«*  nc  *r  »»•  i*  *r  *i*  *r  *i*  *r  **■  n*  *»*  *c  *r  *v*  V  *»*  *r  *r  *i»  *»*  3r  nr  *»*  n*  *c  *p  f  -r  V  *i*  *i*  *r  n*  «v*v  *v  *r  *i*  *r  *•*  **•  i*  *•*  *r  *i*  *P  *r  T 

CREATE    SEGMENT    PROCEDURE    (    MENTOR    SEG    NO  SHORT    INTEGER 

ENTRY_NO  SHORT    INTEGER 

CLASS  LONG 

SIZE  WOE!    } 

RETURNS         (    SUCCESS_CODE  BYTE    ) 

!    ****    NOTE:  REENTRANT      PROCEDURE  **#*    ! 

!    SAVE    LOCAL    VARIABLES    ON    STACK    TC    ENSURE   REENTRANT    ! 

LOCAL        i   M_SEG_ INDEX  SHORT    INTEGER 

ENTRY 

IE    SIZE    >   MAX  SEG    SIZE   THEN 

SUCCESS_CODE    :=    SEGMEMT_TOO_LARGE 
ELSE 

M_5EG_ INDEX    :=   MENTOR    SEG    MO    -   NR   OF   KSEGS 
KPTR    :=   ESTPTR    ITC_GET   SEG    PTR    (    KST    5EG_NO    ) 
IF    KPTR~[M    SEG_INLEX]  .M_5EG    NO    =    NULL_SEG    THEN 

SUCCESS_CODE    :=   MENTOR..S  EG_NOT_XNOWN 
ELSE 

PROC    CLASS     :=   TC   GET    PROC_ CLASS 
CONDITION    CODE    :=    CLASS   EQ    (    PHOC_CLASS, 

KPTR ~TM_ S  EG_ I N DEX J  .  CL  AS S  ) 
IF    CONDITION    CODE    =   FALSE    THEN 

5UCCES5_CODE    :=   ACCESS_CLASS    MOT_EO 
ELSE 

CONDITION    CODE    :=   CLASS    GE    (    CLASS, 

KPTR~[M   SEG    INDEX]. CLASS    ) 
IF    CONDITION    CODE    =  FALSE    THEN 

SUCCESS_COLE    .=    NOT    COMPATIBLE 
ELSE 

HPTR    :=   #KPTR~[M   SEG   IMDEX] .MM   HANDLE 
SUCCESS_CODE    :=   MM_CREATE_ENTRY    (    HPT?, 

ENTRY   NO,  -SIZE,    CLASS     ) 
CONFINEMSMT    CHECK    (SUCCESS    CODE) 
FI 
FI 
FI 
FI 

RETURN 
END-CREATS„SEGMSNT 

1.02 


I  ifi  5»c  ;,c  5»£  »,*  ?,£  j,s  5tJ  *,£  V  *,*  ?(s  i,c  5,<  ifi  it"  *|C  5,1  itc  ^i  j,c  j^i  ;,;  ;%c  »4c  j,c  »,;  ^s  ;,J  ;t;  >,;  ^c  ;,c  ;tc  jtc  ^  j,j  5,1  5,;  ^;  ,(;  ;,c  5|c  5,i  iji  ^c  *4?  ;t;  ;¥i  sjs  jji  i,c  ij£  ;jc  i|c  J,J  i,£  ;[; 
n*  **■ 

*  DELETE  SEGMENT    PROCEDURE .    INVOKED   3Y   SUPERVISOR  * 

*  PROCEDURE    VIA    THE    GATE   KEEPER.    CHECKS    TO    SEE    IE  * 

*  MENTOR   SEGMENT   ENOWN    AND    IE    ACCESS    CLASSIFICATION  * 

*  ARE   EQUAL.    THEN    CALLS   MM    DELETE_EMT?.Y   FO?.   MEMORY  * 

*  MANAGER   ACTION.  * 

ju  „i^  .' *  „v  j*  »•*  , u  »**  »f*  *'*  **•*  *•*  »**  -*-  **#  »•*  ■»•*  »'*  *'*  *'*  »**  ***  ***  >*■*  *'*  »'*  5**  -V  »'*  ***  ■'*  ***  ***  »*■•  -**  *r*  ***  ***  *'*  ***  -**  ***  "^^  *■•*  **■»  *■•*  »**  »'*  *•■*  »'*  ***  *'*  -'*  »'*  *•*  -'*  ***  *'*  t 

»,»  *|»  ?,-»  *|*  »,»  *,»  *|5  *l»  *(*  *p  *V»  rf»   *(*  -,*  «iy*  *,»  rp   »!*  *j*  *f*  *»*  "l*  *V*  *t*  *»*  *P  *^  *t*  *V*  *l*  *<*  "I*  *»*  *»*  1*  "*t*  *«*  *l*  *»*  *l*  *)*  *(*  *tf*  '»*  1*  *l*  ***  *»*  *|P  *l*  ***  "I*  *l*  "l*  *l*  *»*  "l*  1*  f 

DELETE   SEGMENT   PROCEDURE      (    MENTOR   SEG_NC  SHORT    INTEGER 

ENTRY    NO  SEOET_ INTEGER) 

RETURNS  (    SUCCESS_CODE  BYTE    ) 

!    ****    NOTE:         REENTRANT      PROCEDURE  ****    ! 

!    SAVE    LOCAL    VARIA3LES    ON    STACK    TO    ENSURE    REENTRANT    ! 

LOCAL  M.SEG_INDEX  SEORT    INTEGER 

ENTRY 

M   SEG    INDEX    :=   MENTOR   SEG_NO    -   MR    OE_KSEG3 
KPTR    :=   KSTPTR    ITC    GET    SEG   PTR    {    EST    SEG    NC    ) 
IE    £PTR~[M  SEG    INDEX]  .M_SSG    NO   =    NULL_SEG   THEN 

SUCCESS_CODE    :=   MENTOR    SEG    NOT    KNOWN 
ELSE 

PROC    CLASS     :=   TC   GET.PRCC    CLASS 
CONDITION_CODS    :=    CLASS   EQ    (    PROC_CLA5St 

KPTR~[M_SEG    INDEX]  .CLASS         ) 
IE    CONDITION_CODE    =   FALSE    THEN 

SUCCESS    CODE    :=   ACCESS    CLASS    NOT    EO 
ELSE 

HPTR     :=   #KPTR~[M_SEG    I NDEX]  .MM_HANDLE 
SUCCESS    CODE    :=   MM    DELETE  ENTRY    (    HPTR,    ENTRY_NO    ) 
CONFINEMENT    CEECK    ( SUCCESS_CCDE  ) 
FI 
FI 

RETURN 
END   DELETE    SEGMENT 
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(«l*  »•*  *'*  *•*  »>-  *i*   »•<•  »'*  *•*  »•-  4+   %•*  *'*  *^*  »'*  **•  »*<»  »'*  »'*  -'-  »**  »**  V*  *'*  *'*  *'*  »**  ***  »•*  %'•  ***  %M  *'*  •.'*  »'*  *'-  *'-  »'»  »•*  *»*  *'*■  »•*  »»*  *»«.  %'*  *l-  J*  »•*  »•-  ■*'#  >JL  »t„  -i-  ,.»,  ,i-  fci.  o*  ».t* 
'i-  n*  i**!*  *»*  i*  *i*  *i*  *r»  i*  i*  i»  *i**v>  **»  -i-  ».-*  *r*«v  '("i*  *v»  *!*»!•  *t*»r  »i»  »»*  *i*  *p  *r  *P  -i-  *r»  i'  *r  *p  *t*  "i*  »i»n*  »i*  5p*F  »**  *»»  *v*»*  »8»n*  *.**i*  *»»*i*  *v  *»*  *r  *»* 

*  MAKE    KNOWN   PROCEDURE.    INVOKED   BY   SUPERVISOR  * 

*  PROCEDURE   VIA   GATE  IEEPER .    CHECKS    TO    SEE    II  * 

*  MENTOR    SEGMENT    KNOWN.    SEARCHES    KST    TO    SEE    IF  * 

*  SEGVENT    ALREALY   KNOWN    (WHILE    ALSO    NOTING    TEF  * 

*  FIRST    AVAILABLE    (UNUSED)    SEG    #).    IF   THE    SEGMENT  * 

*  IS    ALREADY   KNOWN    THEN   FINISHED.    IF   NOT,    THEN,  * 

*  USING    THE   AVAILABLE    SEG    #,    CALL    MM_ACTIVATI        FCR  * 

*  MEMORY    MANAGER    ACTION.    THEN    CHECK    TO    SEE    IF    AMY  * 

*  ACCESS    IS    ALLOWED.    IF   YES    THEM    DETERMINE    THE  * 

*  APPROPRIATE    ACCESS    ALLOWED    AND    UPDATE   KST.    IF 

*  NO,    THEN  RETURN    NULL    ACCESS.  * 

i*  *v 

«.'»  »**  %*f   «>«  »*■»  »**  J*  »'-  *l«  *■*  »'»«,•*  •.**  »'*  *i*  »l#  -'-  »l#  *•*  «.'-  *■'*  V*  "***  -»**  *■**  »**  V**  ***  »**  »**  -1*  *'*  -'*  +9*    ***  *'*  "•*'•  *■**  »'-  *"*  »'***»  «J*  ,'..  O*  »'*»»*  fc>*  »»*  .'»■.'-*  »<*  *IU  t'*  »<*  »•*  ■»•-  fcl*   ■ 
*■,*  *l*  *|fc  *,•  »l»  *l»  J[»  *,»  *,»  *TJ»  *j»  *f»  *|»  *l»  *j*  *y»  »|»  *|»  *|»  *!»  *j*  *p  *y»  »,»  *|»  *,»  *|»  Jp  «p  *|»  *,>  #,*  *p  »,-  *p  *,x  *p  rp  .rp  *p  #p  *f*  f|«  »,-»  ,,»  *p  *t«  «,*  «p  ^i,  *!»  ,,»  *^»  ^p  *y-  *-,-  ^,%  »(h   J 

MASE_KNO'.\rN    PROCEDURE       (    MENTOR   3EG_NO  SHORT_INTEGER 

ENTRY    NO  SHORT_INTEGER 

ACCESS    DESIRED  EYTE    j 

RETURNS  (    SEGMENT    NO  SHORT_INTEGER 

ACCESS    ALLOWED  ^YTE 

SUCCESS    CODE  EYTE    ) 

,    $$$*    NOTE:  REENTRANT      PROCEDURE  ****    ! 

!    SAVE    LOCAL   VARIABLES    ON    STACK    TO   ENSURE   REENTRANT    ! 

LOCAL 

AVAIL_SEG    SHORT    INTEGER 
INDEX  SHORT    INTEGER 

DBR   NO        SECnT    INTEGER 
M  SEG   INDEX  SHORT_ INTEGER 

ENTRY 

M    SEG    INDEX    :=    MENTOR    SEG_NC    -   NR   OF   K3EG5 
KPTR    :=  KSTPTR    ITC   GET   SEG    ?TR    (    KST   SEG    NO    ) 
IF    KPTR~[M_SEG    INDEX] .M    SEG    NO    =   NULL_SEG    THEN 
SUCCESS_CODE    :=   MINTCH    SEG_ NOT_KNOWN 
SEGMENT    NO    :=   NULL   SEG 
ACCESS   ALLOWED    :=    NULL    ACCESS 
ELSE 

PROC    CLASS     :=   TC_GET    PROC    CLASS 
HPTR":=   #KPTR~[M   SEG    I NDEX]  .MM_HANDLE 
INDEX    :=   e 

SEGMENT_NO    :=   NULL    SEG 
AVAIL  SEG    :=   NULL    SEG 
SEE    If _ KNOWN: 
DO 

IF    KPTR^  [INDEX]  .M    SEG_NO    =    MENTOR_SEG_NO 
ANDIF    KPTR^LlNDEXj .ENTRY_ NUMBER    =   ENTRY    NO    THIN 
rCASE:    SEGMENT    ALREADY    KNOWN! 
SUCCESS    CODE    :=   SUCCEEDED 
SEGMENT    NO    :=    INDEX    +    NR    OF_KSEGS 
ACCESS   ALLOWED    :=   K?TR~  [INDEX] .ACCESS.MOEE 
EXIT      SEE_IF_KNOWN 

1£4 


ELSE 

IF        £PTR~  [INDEX]  .M   SEG    NO    =    NULL    SEG 
AMDIF    AVAIL_SEG    =    NULL   SEG    TEEN 

ATAIL  SEG    :=    INDEX    +   NR_OF_KSEGS 
FI 

INDEX    -=   1 

IF    INDEX   >    MAX_NC   KST    ENTRIES    THEN    EXIT   FI 
FI 
OD 
!    EXIT    SEE    IF   KNOWN    ! 
IF    SSGMENT_NO   =    NULL    SEG 

ANDIF   AVAIL   SEG   <>    MULL    SEG    TEEM      !CASE:    SEGMEMT    MOT 

KNOWN    AND   SEG   #    IS    AVAILAPLE! 
INDEX    :=  AVAIL_SEG    -    NP._OF_K5EGS 
SEGMENT_NO    :=    AVAIL    SEG 
DER_NO    :=   TC    GET   LBR    NO 
SUCCESS_CODE,K?TR~[lNDEX]  .CLASS ,KPTR~ [INDEX]  .SIZE: 

MM_ACTIVATE(DBR_NO,E?TE  ,ENTRY   NO, SEGMENT    NO) 
CGNFINEMINT_CEECK    "(SUCCESS    CODE," 
IF   SUCCESS   CODE   =    SUCCESDEJ    THEN 

COMDITIOM    CODE    :=    CLASS    GS    (    ?RQC_CLA5S  , 

KPTR~  [INDEX] .CLASS    ) 
IF    CONDITION_CODS    =   FALSE    THEM    !NO    ACCESS! 
ACCESS    ALLOWED    :=    MULL    ACCESS 
SUCCFSS_COIE    :=   MM   DEACTIVATE    (DEE   NC,EPTR) 
CONEINSMENT_CHECK    (SUCCESS    CODS) 
SUCCSSS_CODE    :=   PROC    CLASS    MOT_GE_SEG    CLASS 
SEGMENT    NC    :=    NULL   SEG 
ELSE 

COMDITIOM    CODE    :=    CLASS    EG    (    ??.OC_CLASS, 

KPTH'TlNDEX]  .CLASS    ) 
IF    CONDITION_CODE    =  TRUE 
AMDIF   ACCESS    DESIRED    =   WRITE    TEEM 

ACCESS    ALLOWED    :=   WRITE 
ELSE 

ACCESS    ALLOWED    :=  READ 
FI 

£PTR~  [INDEX] .IN   CORE-  :=   FALSE 
SPTR" [INDEX] .M   SEG_ MO    :-   MENTOR    SEG    NO 
KPTR~ [INDEX] .ENTRY   NUMBER    :=   ENTRY   NO 
KPTR" [INDEX] .ACCESS    MODE    :  =   ACCESS, ALLOWED 
FI 
ELSE 

SEGMENT    MO    :=   NULL    SEG 
ACCESS    ALLOWED    :=    MULL   ACCESS 
FI 
ELSE 

SUCCESS_CODS    :=   NO_SEG  AVAIL 
SEGMENT_NO    :=    NULL_SEG 
ACCESS    ALLOWED    :=    NULL   ACCESS 

FI 

RETURN 
EMD  MAKE_KNOWN 
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*r  *p  *i*  *i*  *i*  *r  *»*  *»*  *«*  i*  *•*  'i*  *»"  *»*  *<*  *»*  *F  *i*  *K*  *»"■  *<*  *»*  ***  *»* 

*  * 

*  TERMINATE   PROCEDURE.    INVOKED    Tf      SUPERVISOR  * 

*  PROCEDURE   VIA    SATE   KEEPER.    CHECKS    TO   SEE    IF  * 

*  SEGMENT      IS  KNOWN   AND    IF   SEGMENT    NUMBER    IS  * 

*  VALID.    IF    CHECKS    ARE    SATISFACTORY   THEN    MM_DEACTI-  * 

*  VATE    IS    CALLED    FOR    MEMORY    MANAGER    ACTION.  .  * 

,1*  JU 

;,%  ?|*  j,j  J»»  ',*  ^  i,c  ;,i  *,t  i.»  ^*  «!«  ;,c  j,» ;,;  ;t*  ;,*  «^»  ^c  >,»  J,*  *,»  *,%  ;,j  *,%  ^»  -,s  i,»  j,»  -,c  ,,j  i,c  ^t ;,- ;,;  ;,~  ,,£  »,;  *,c  ;,i  jtt  -,£  *,c  ;,£  2,*  i,t  j,»  ;,»  ;,c  ;,c  *,£  i,c  ^i  5,c  ifi  ^i  *ti  ?p  f 

TERMINATE   PROCEDURE      (    SEGMENT    NO        SHORT    INTEGER    ) 
RETURNS  (    SUCCESS^ CODE   BYTE    ) 

,    «**#  MOTE:      REENTRANT    PROCEDURE  ****    ! 

!    SAVE    LOCAL    VARIA3LES    ON    STACK    TO    ENSURE   REENTRANT    ! 

LOCAL  INDEX  SHORT    INTEGER 

DER   NO        SEOxiT_  INTEGER 
ENTRY 

INDEX    :=  SEGMENT_NO    -   NR   OF   KSEGS 

KPTR    :=   KSTPTR    ITC    GIT   SEG_PTR    ,    KS'i    SEG^NO    ) 

IF    KPTR" [INDEX], M.SEG   NO    =   NULL   SEG   THEN 

SUCCESS    CODE         :=    SEGMENT.NOT    KMOWN 
ELSE 

IF    KPTR"  [INDEX] .IN    CORE    =TRUE   THEN 
SUCCESS_CODE    :  =    SEGME  MT_  I  .\i_CORE 
ELSE 

IF   SEGMENT   NO'  <    NR   OF   KSEGS 

SUCCESS-CODE    :  =   KERNEL  SEGMENT 
ELSE 

IF  SEGMENT   NO    >   MAX   SEG   NC   THEN 

SUCCESS_CODE    :=    INVALID  SEGMENT_NO 
ELSE 

HPTR    :=    #KPTR~  [INDEX]  .MM_HANDLE 
D3R    NO    :=    TC   GET  DBR   NO 

SUCCESS_CODE~ :=   MM   DEACTIVATE    (LrR   NO,EPTR) 
C0NFINEM2NT_CHECK    (SUCCESS    CODE) 
IF   SUCCESS    CODE   =  SUCCEEDED    THEN 
KPTR" [INDEX] .M  SEG   NO    :=   NULL 
FI 
FI 
FI 
FI 
FI 

RETURN 
END   TERMINATE 
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!««*  %.•*   <J~  «l*  »•-  -'*   »'-  »•*  »»rf  V'  •*'-  -'-  «•-  -1*  »'»  »'*  »'■*  *■'*  -'-  -  '*  "'-  »'»  *•-  -'*  »■*  »'-  •>'>  -'*  «**  -'-  -'<•  -'-*  *■'-  »•»  -•■'  «J<r  »'*  »'•*  »'*  »'*  -''    «**  >'-  *•<  *'*  **'  »'*  •.'-<•  *■'*  -**  *'*  *M*   »'*  »'-  Jb  ■»''  -'*  -'' 
. ,-  #|»  *!%  n»  »,»  *i»  *|»  *|»  #|»  *p  i*  *i»  *t*  *i*  n*  *i*  ***  *t*  i*  *»  *i*  *v*  *i*  *i*  *»*  *v*  *i*  *r*  *v*  *»*  *»*  *p  *i*  »»*  *i-  *i»  *i*  i*  »»••  »»*  i*  i*  'i*  *i*  *r*  *»%  **"  *v*  *»■*  *i*  *»*  *•*  *•*  *i*  "i*  *i*  *»"  *i* 

*  * 

*  SM   SWA?    IN    PROCEDURE.    INVOKED    3Y    SUPERVISOR  * 

*  PROCEDURE    VIA    TEE    GATE    KEEPER.    CHECKS    TO    SEE    IF  * 

*  SEGMENT    KNOWN?     IE   YES    THEN    CALLS    MM_5WA?_IN    TOR  * 

*  MEMORY   MANAGER    ACTION.  * 

*  * 

»i«  »•*  .'»  O*  »'#  »'-  •>'*  •*>+  V*  *•**  *'*  *•-  *■''  ■■'*  -'*  »'■»  "■'*  »'■*  *>*'  V'  "■'*  *'*  *■'*  »**  »**  ■J"  -''  -'*  v'*  *>*>  »'*»1*  «'*  »•*  »'<•  *■'*  -'*  **#  -'-  *'-  *.*-  V'  *•**  V*  -»'"  *'-«'*  »■'  V-  *■''  v<*  »*»  O*  *•'-  -'*  -'-  -■-  »'.  ■ 
»(»  #l»  *,»  -i*  *(*  *|*  *l»  *f*  ^*  *(»  *|»  *|*  *|»  »|»  *y»  ?(*>  *i«  *|»  »f»  *|-  *|*  *|»  *i»  *|»  *i»  *|»  *j*  #(•  »4*  *f»  *(•  <f  *l»  *(■  »»*  »|»  *(•  *(i  *i*  *\-  »p  *(»  »|»  *"!»  »|»  »|*  *)»  *|*  *t»  *i*  »,»  *|*  ^o  *|»  »(»  J(*  »j»  *(»  f 

SM_SWAP    IN    PROCEDURE      (    SE&M3NT_^0        SHORT    INTEGER    ) 
RETURNS  (    SUCCESS_CODE   EYTE   1 

,    **^-  NOTE:      REENTRANT   PROCEDURE  *#**    ! 

!    SAVE    LOCAL    VARIAPLES    ON    STACK    TO   ENSURE   REENTRANT     ! 

LOCAL  INDEX  SEORT_I NTSGER 

DBR_NO        SHORT    INTEGER 
ENTRY 

INDEX    :=  SEGMENT   NO    -   NE  OF   KSEGS 

KPTR    :=   KSTPTR    ITC    GET   SEG    PTR    (    KST_SEG_MJ    ) 

IF   KPTR~ [INDEX] ,K   SEG   NO    =~NULL   SEG   TEEN 

SUCCE53_CODE         :=    SSGMENT_NOT    KNOWN 
ELSE 

IF    KPTi"  [INDEX]  .IN    CORE    =   TRUE   THEM 

SUCCES3_CODE    :=    SUCCEEDED 
ELSE 

EPTR         :=   #KP1R~!*INDEX]  .MM  HANDLE 

DBR_NO    :=   TC_GET_DER    NO 

3UCCESS_CODE         :=   MM" SWAP   IN    (    EPTR,    D3R_SO, 

KPTR"[INDZX]  .ACCESS    MODE    ) 
CONFINEMENT   CHECK    ( SUCCE33_CODE  ) 
IF        SUCCESS    CODE    =   SUCCEEDED   THEN 

KPTR~  [INDEX]  .IN_CCEE    :=TRUE 
FI 
FI 
FI 

RETURN 
END    SM    SWAP    IN 
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-,»  #|«  *y*  T*  *»*  *»*  'I**  *P  't*  "V*  ***  *»*  "l"  1*  *•*-  'I*  *»*  *1*  *l*  *l*  *P  *l*  *i*  *l*  *l*  *»*  *i*  *i*  ■*•*  *«*  'l*  *»*  *i*  'i*  *"l*  *i*  *i*  "I*  TT  1*  ***  '(*  *l*  *l*  "i*  *l*  "V*  *t*  T*  "I*  *l*  '»"■  *K*  #l*  *f"  'l*  *l*  *»■* 

»•*  »** 

*  SM  5WA?   OUT   PROCEDURE.    INVOKED   3Y  SUPERVISOR  * 

*  PROCEDURE   VIA   THE   GATE   KEEPER.    CEECKS    TO    SEE    IE  * 

*  SEGMENT    KNOWN?    IF    YES    TEEN    MM    SWAP    OUT    IS    CALLED  * 

*  EOR    MEMORY    MANAGER    ACTION.  * 

„i,  «J~  *■#  »...  *JU  %*»  »•*  .'-  »•-  -*-  «J*  O-  J*  -J****  ».»*  •.»#  »'*  »**  «'»  »<*  *J-  v»#  .'-  »>-  *<*  *»,*  *»-  V*  »•*  *V  *'*  *"*  *•'*  *■**  »■'■•  •**  *'*  *•-  *-'*  *■'*  "*f  "'*  *'-  *■**  ■J*  -**  •"'  »l"  »•*»**  v^  v*  «.•*  *.i*  %•*  »•*  o*  I 

»(*  *|*  *,»  *,*  *,-  »|»  *|*  -,■»  #,<»  >|*  *^*  *^*  *»■»  *■,»  *|*  *^»  #i»  *»■»  *!■•  •'i*  *,■•  #|»  #^  *,»  #|*  *p  •)■*  *f*  *v»  #y»  *y*  *i*  *i*  *i*  'I*  *»*  *»■*  rv  *t*  'i  *i%  *»s  i*  if*  *•*  *»*  *r*  *i*  *r*  *»*  *i*  *i*  *i*  'i"  •v  *i"  *f*  *!*•  " 

■  SM    SWAP.OUT    PROCEDURE      (    SEGMENT_NO        SH0RT_ INTEGER    ) 
RETURNS  (    SUCCESS_CODS    3YTE    ) 

j    *#*#  NOTE:      REENTRANT    PROCEDURE  ****    ! 

!    SAVE    LOCAL   VARIABLES    ON    STACK    TO   ENSURE    REENTRANT    ! 

LOCAL  INDEX  SEOaT   INTEGER 

DBR_NO        SEORT_ INTEGER 

ENTRY 

INDEX    :=   SEGMENT    NO    -    NR   CI   KSEGS 

KPTR    :=  KSTPTR    ITC_GET_SEG_  PTR    (KST    SEC-    NO    ) 

I?    KPTR~[INDEX]  .M_SEG_NO    =    MULL   S3G~THEN 

SUCCESS    CODE         :=    SEGMENT    NOT    KNClvN 
ELSE 

IF   KPTR" [INDEX]  .IN    CORE    =   FALSE   TnEN 

SUCCESS_CODE    :=    SUCCEEDED 
ELSE 

HPTR         :=   #K?TR"[IMDEX]  .M^   HANDLE 
DBR    NO    :=    TC    GET-  DBR    NC 

SUCCESS_CODE         :=   MM    SWAP_OUT    (    DBR    NO, HPT?.    ) 
CONFINEMENT   CHECK    ( SUCCES5_CODE  ) 
IF   SUCCESS    CODE    =   SUCCEEDED    TEEN 
KPTR"  [INDEX]  .IN    COPS    :=  FALSE 
FI 
FI 
FI 

RETURN 
END    SM    SWAP    CUT 
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*  CONFINEMENT   CHECK    PROCEDURE.   SERVICE   PROCEDURE   TO 

*  ENSURE    NC   SECURITY    VIOLATION    OCCURS    WHEN    INFO    IS 

*  PASSED   OUT    OE    THE   KERNEL    VIA   THE    SUCCESS    CODE. 

*  CALLS    ASSEMBLY   PROCEDURE    -   MONITOR    WHICH    IS    TO 

*  CAUSE    A   JUMP    1C    TEE   MONITOR'S    ADDRESS    %g59A. 
# 

Jb  *v  **•  »**  -'•»  **■  "**  ***  ***  -1*  "•'*  *'*  -'-  *'*  *V  »**  -'*  "'■*  -'-  -'*  *'■'  *•*'  -'■•  "'•*  *■'*  -'■*  *V  -'"  *•*  •'*  •*•*  *'•*  *''  "-'*  •>•*  *'*  ^'-  *•*-  •*'*  «'*  •'*  *'e  *•'• 

»(»  *)>  *,»  *(»  -,-  *if%  *j>»  *|»  *|*  +f*   *f  *|*  *(*  *y»  -,»  »|*  *|*  *%*  *j»  *|»  *)<■  >|«>  »|*  *I*  »|»  *|»  *(fc  *|»  *(*  >|^  »|*  »!»  »,%  *|»  #t»  *|*  *(»  *t^  *tf»  *(>  *|"*  *|*  *,• 

CONFINEMENT_CHEC£   PROCEDURE      ( SUCCESS_CODE      FYTEy 

,    *«##  NOTE:      REENTRANT    PROCEDURE  ****    ! 

!    SAVE    LOCAL    VARIABLES    ON    STACK    TO   ENSURE   REENTRANT    ! 

ENTRY 

IE    SUCCESS_CODE 

CASE    LEA?    SEG_ZXISTS    THEN 

MONITOR    ! EXIT    SYSTEM! 

CASE    NO  LEAP   EXISTS    THEM 

MONITOR    !ZXIT    SYSTEM! 

CASE    ALIAS_DOSS_NOT    EXIST    THEN 

MONITOR    ISXIT    SYSTEM! 

CASE    NC_CHILD_TC_DZLETE   TEEN 

MONITOR    !EXIT    SYSTEM! 

CASE    G   A3T_FULL    THEN 

MONITOR    !ZXIT    SYSTEM! 

CASE    L   AST_FULL    THEN 

MONITOR    !EXIT    SYSTEM! 

CASE    LOCAL  MEMORY    FULL   TEEN 

MONITOR    !EXIT    SYSTEM! 

CASE    GLOBAL_MEMORY    FULL   THEN 

MONITOR    !ZXIT    SYSTEM! 

CASE    SSC_3TOR   FULL    THEN 

MONITOR    !EXIT    SYSTEM! 
FI 

RETURN 
END   CONFINEMENT   CHECK 
END   SEGMENT    MANAGER 
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APPENDIX  C  -  DISTRIBUTE!  MEMORY  MANAGER  PLZ/SY5  LISTINGS 


DIST  MMGR  MODULE 


CONSTAN* 


CREATjl_ENTRY_CODE 

DELETE_ENTRY_CODE 

ACTIVATE_SEG_CODE 

DEACTIVATE    SEG_CCDE 

SWAP    IN   S EG   CODE 

SWAP_OUT_SEG_CODE 

NO_OF„PROCE5SGRS 

MAX    NO_KST    ENTRIES 

MAX_SEG_SIZE 

MAX_DBR_NC 

NR_OE_KSEG3 

KST    SEG    NO 


51 

52 

53 

54 

55 

1 

?? 

?? 

4 

?? 
?? 


TYPE 


H_ ARRAY 
COM_MSG 

CREATE    MS 


DELETE    MS 


ARRAY    [3        WORD] 

ARRAY    [16      BYTE] 

RECORD    [CREATI_CODE 
CE_MM_ HANDLE 
CE   SNTRY_NO 
CE  EIILEH 
CE_SIZE 
CE„CLA5S 

RECORD    [DZLETI_C0D2 
DE    MM    HANDLE 
DE~ENTRY_NO 

de'eillzr 


WORE 

H    ARRAY 

SHORT. INTEGER 

BYTE 

WORD 

LONG] 

WORD 
H_ ARRAY 
SHORT   INTEGER 

ARRAY  [?    PYTE]] 


ACTIVATE.MSG        RECORD    [ACTI VATE_CODE    WORD 


DEACTIVATE  MSG 


RECOR- 


A    DBR_NO 
A    EILLER1 
A_MM_HANDLE 
A   ENTRY    NO 
A_ SEGMENT, NO 
A>ILLER2 

[DEACTIVATE 
D   LBR.NO 
D" EILLER1 
D    MM_ HANDLE 
D"ZILLZR2 


SHORT    INTEGER 
BYTE 
E_ ARRAY 
SEORT    INTEGER 
SECRT    INTEGER 
LONG] 

CODE   WORD 

SEORD  INTEGER 

BYTE 

H  ARRAY 

ARRAY  [3  'A'CRD]] 
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SWAP    IN_MSG  RECORD    [SWAP, IN    CODE      WORD 

SI, MM    HANDLE      E   ARRAY 
SI_DBR    NO  SHORT    INTEGER 

SI    ACCESS_AUTH    BYTE 
SI_FILLER  ARRAY [3   WCRD]] 

SWA?    OUT    MSG  RECORD    [SWAP    OUT    CODE   WORD 


SO   DBR    NO 

so'fiileri 
so  mm  handi 

S0_FILLER2 

SHORT    INTEGER 
EYTE 
,E      H    ARRAY 

ARRAY [3   WORD]] 

R_SUC_CODE 

RECORD    [SUC    CODE 
SC    FILLER 

] 

BYTE 

ARRAY  [15    BYTE] 

R_ACTIVATE_ARG 

RECORD    [R    SUC    CODE           BYTE 

R   FILLER               BYTE 
R    MM    HANDLE        E    ARRAY 
R  "CLASS                  LONG 
R_SIZE                    WORD] 

CE_PTR 

~CREAT2_MSG 

DE_PTR 

~DELETI_MSG 

A_?TR 

~ACTIVATE_M3G 

D_PTR 

~DEACTIVATE_MSG 

SI_PTR 

~SWAP._IN_MSG 

SO_PTR 

~SWAP_OUT_MSG 

• 

SC_PTR 

~R_ SUC _ CODE 

ARG_PTR 

~R_ACTIVATE_ARG 

KST_REC 

RECORD    [    MM   HANDLE 
SIZE 

ACCESS    MODE 
IN    CORE 
CLASS 
M    SEG    NC 
ENTRY" NUMBER 

H    ARRAY 
WORD 
BYTE 
EYTE 
LONG 

SECRT    INTEGER 
SHORT    INTEGER    ] 

KST  ARRAY       [   MAX   NO   KST   ENTRIES    KST    REC    ] 
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K3TPTR 

KST 

ADDRESS 

WORD 

SEG  DESC  REG 

RECC 

r^Mu 


KM_V?_ID 
SEG_ARRAY 

SEGPTR 


RECORD    [BASE   ADDR      ADDRESS 
LIMIT  BYTE 

ATTRIBUTE      3YTS] 

RECORD    [SDR      ARRAY    [NO    SIG    DESC   REG 

3SG_DESC_REG] 
BLKS   USED      'JORd 
KAX^BIKS        WORD] 

WORD 

ARRAY     [MAX_SEG_3IZE  3YTE] 

~SEG    ARRAY 


INTERNAL 

MM_CPU„ TABLE 

EXTERNAL 

MMU_IMAGE 

G_AST_LOCK 

K_LOCK 

K_UNLOCK 

ITC_GET_CPU_NO 

SIGNAL 

WAIT 


ARRAY     [MO..  0?..  PROCESSORS    MM_VP_ID] 

ARRAY    [MAX_DBR_NO      MMU] 

BYTE 

PROCEDURE 

PROCEDURE 

PROCEDURE 

PROCEDURE 

PROCEDURE 
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**»  i'X 

*»*  * 

*  MM    CREATE   ENTRY    PROCEDURE.    INVOKED   BY    SEGMENT  * 

*  MANAGER'S    CREATE_SEGMENT    PROCEDURE.    PERFORMS    TYPE 

*  CONVERSION    OF  POINTERS,    LOADS    MESSAGE   ARRAY    FOR  * 

*  IPC,    AND   PERFORMS    IPC   WITH    MEMORY   MANAGER    PROCESS.  * 

*  RETURNS    SUCCESS    CODE.  * 
$                                                                                                                                          * 

ju**#  ->*,.>*  *j>  »•#  »i*  -»■-  •.'*  -*-■  -'-  *'-  *•-  „>,  *Jtt  <j+  »ji*  »•*  »(*  «***  ■«.<«.  ***  *'*  ^'-  *<-  -.'-  »t*  ^1*  «.**  »**  «.»*  *f*  o*  J*  »'*  •»•*  *'*  »'*  »'*  *'*  *'**  i^i  *•*£  *■*■*  *'*  s*£  *1-  *'*  *'*  *'*  Vs  *'•'  i!*  i!l  i'*  *$*  *'*  i'**  1 
;,t 5,. ,, -  *£  zfi  ?,-.  i*  *■»» i* *»-  *r *»*  *»*  'i*  i*  *»*  *v *p  *i* *r  "■*  *»* *«*  n* *r  *»* t  "*■  TT*r*r¥¥*r1  n? *v  *P  *i* *v  *r  *»* *r  *r  ***  *r »r»  *v  i-  nr 5r  *r  *p  i*  **•  *»»  v **•  I 


MM    CREATE_ENTRY      PROCEDURE      (    HPTR  H_AERAY 

ENTRY   NO  SHORT    IMTEGSR 

SIZE  WORD 

CLASS  LONG    ) 

RETURNS  (    5UCC2SS_C0DE  BYTE    ) 

I    *#**    NOTE:  REENTRANT      PROCEDURE  ****    ! 

!    SAVE    LOCAL   VARIABLES    ON    STACK    TO    ENSURE   REENTRANT     ! 

LOCAL        CE    MSGPTR  CE_PTR 

COM  MSGBUE        COM_MSG 
COM_ MSGPTR        "COM    MSG 
SU(f  CODE_PTR    SC_?TR 

ENTRY 

COM    MSGPTR  :=   #COM    MSGBUF 

!    TYPE    CONVERT   TO   OVERLAY    ARGUMENT   LIST    ONtC    MSG    LIST    ! 

CE    MSGPTR  :=    CS_PTR   COM_MSGPTR 

!    LOAD    ARG   LIST    ONTO    MSG    ARRAY    ! 

CE    MSGPTR". CREATE    CODE    :=    CREATE_ENTRY    COLE 

=   HPTR"  [21]" 

=   HPTR^Tl] 

=   HPTR"  [2] 
CE_MSG?TR".CS_ENTRY_NO    :=   ENTRY_NO 
CE_MSGPTR".CE    CLASS    :=   CLASS 
CE_MSGPTR".CE_SIZE      :=   SIZE 
PERFORM_IPC    (COM_MSGPTR) 

I    TYPE    CONVERT    TO    OVERLAY    MSG   ARRAY   ONTO    RET    ARG    LIST    ! 
SUC    CODE_PTR    :=   SC_PTR    COM   MSGPTR 
SUCCESS_CODE    :=   SUC_CODE    PTR".SUC    CODE 
RETURN 
END   MM    CREATE    ENTRY 


CE>SGPTR".CE_MM_HANDLE[0] 
CE_MSGPTR". CE_MM_ HANDLE [1] 
CE_MSGPTR".CE_MM_EANDLE  [2] 
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*  MM   DELETE_ENTRY    PROCEDURE .    INVOKED   EY   SEGMENT  * 

*  MANAGER'S    DELETE   SEGMENT    PROCEDURE.    PERFORMS    TYPE  * 

*  CONVERSION    OE   POINTERS,    LOADS    MESSAGE   ARRAY    FOR  * 

*  IPC,    AND    PERFORMS    IPC   WITH    MEMORY   MANAGER    PROCESS.  * 

*  RETURNS    SUCCESS, CODS.  * 
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MM    DELETE_ENTRY      PROCEDURE      (    EPTR  ~H_ARRAY 

ENTRY    NO  SECRT_ INTEGER) 

RETURNS  (    SUCCESS.CODE        BYTE    ) 

!    ****    NOTE:  REENTRANT      PROCEDURE  ****    ! 

!    SAVE    LOCAL    VARIABLES    ON    STACK    TO   ENSURE   REENTRANT    ! 

LOCAL        DE„MSG?TR        DE_PTR 
CCM_MSGBUE      COM_MSG 
COM   M3GPTR      ^COM    MSG 
SUC"CODE„PTR    SC_?TR 

ENTRY 

COM    MSGPTR  :=    #COM   MSGBuE 

!    TYPE    CONVERSION    TO    OVERLAY    ARG    LIST    ONTO   MSG    ARRAY    ! 

DE_MSGPTR    :=    LE_?TR    CCM_M5GPTR 

!    LOAD    ARG    LIST    ONTO    MSG    ARRAY    ! 

DE_MSGPTR~. DELETE    CODE    :=   DELETE   ENTRY   CODE 

DE_MSGPTR~. LE_MM_ HANDLE [e] 

DE_MSGPTR".DE_MM_HANDLE[l] 

DS_MSGPTR".DE   MM_fiANDLE[2] 

DE_MSGPTR'x.DE_ENTRY_NO    :=  ENTRY  NO 

PERFORM   IPC    (COM_MSG?TR) 

!    TYPE    CONVERT    TO    OVERLAY    MSG    ARRAY   ONTO    ARG   LIST     ! 

SUC    CODE_PTR    :=   SC_PTR    COM   MSGPTR 

SUCCESS    CODE    :=   STJC_CODS_PTR~  .SUC_CODE 

RETURN 
END  MM   DELETE   ENTRY 


=  t?TR~U] 
=  IPTR~[1] 
=   HPTR"[2] 
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*  * 

*  MM_ACTIVATS    PROCEDURE.    INVOKED   BY   SEGMENT   MANA-  * 

*  GER'S    MAO  KNOWN    PROCEDURE.    PERFORMS    TYPE    CONVERSION  * 

*  OE    POINTERS,    LOADS    MESSAGE   ARRAY    FOR    IPC,    AND   UP-  * 

*  DATES    MM    HANDLE    ENTRY    IN    1ST    AFTER    PERFORMING    THE  * 

*  IPC.    RETURNS    SUCCESS_CCDE,    CLASS,    AND    SIZE.  * 

*,%  *r 
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NK   ACTIVATE      PROCEDURE      (    DER    NO  SHORT_ INTEGER 

HPTR  "H_ ARRAY 

ENTRY    NO  SHORT    INTEGER 

SEGMENT    NO        SHORT    INTEGER    ) 
RETURNS  (    SUCCESS_CODE   BYTE 

CLASS  LONG 

SIZE  WORD    ) 

,    ****    NoTE:  REENTRANT      PROCEDURE  ****    ! 

!    SAVE    LOCAL    VARIABLES    ON    STACK   TO   ENSURE    REENTRANT    ! 

LOCAL        A_MSGPTR        A_?TR 

COM_MSGRUF      COM_MSG 

COM_MSGPTR      ^COM    MSG 

RET_ARG?TR      ARGPTE 

KPTR  KSTPTR 

INDEX  SHORT. INTEGER 

ENTRY 

COM    MSGPTR    :=    #COM_MSGBUF 

!    TYPE    CONVERT    TO    OVERLAY    \RG    LIST    ONTO    MSG    ARRAY    ! 
A_MSGPTR    :=  A_PTR    COM_MSGPTR 
!    LOAD    ARG   LIST    ONTO    MSG    ARRAY    ! 
A    MSGPTR". ACTIVATE_CODE    :=   ACTIVATE   SEG_CODi 
A   MSGPTR". A.  DBR   NO    :=   DBR   NC 
A>SGPTR~.A_MM_HANDLE[0]     :=   HPTR"  [2] 
A    MSGPTR". A    MM    HANDLE  [l]     :=   H?TR"ri] 
A_ MSGPTR". A_MM    HANDLE [2]     :=   HPTR"  [2] 
A_MSG?TR".A_ENTRY_NO    :=   ENTRY    NO 
A   MSGPTR". A_SEGMENT    NO    :=   SEGMENT    NO 
PERFORM, IPC" ( COM   MSGPTR ) 

!    TYPE    CONVERT    TO   OVERLAY    MSG    ARRAY   ONTO   RET    ARG    LIST    ! 
RET    ARGPTR    :=  ARG   PTR   COM    MS'GPTR 
SUCCESS    CODE    :=  RET   ARGPTR". R   SUC    CODE 
CLASS    :=   RET_ARGPTR".R_CLASS 
SIZE    :=  RET_ARGPTR".R_SIZE 
INDEX    :=   SEGM£NT_NO    -   NR    CF_KSEGS 
!    RETRIEVE    HANDLE   AND   UPDATE    KST    ! 
KPTR    :=   KSTPTR   MM   GET  KSEG   PTR    (    SEG_NO    ) 
EPTR    :=   #KPTR"  [INDEX]  ,MM_HANDLE 
HPTR"[0]     :=   RET_ARGPTR".R  MM  HANDLE  [0] 
HPTR"[1]     :=  RET_ ARGPTR". R   MM~EANDLfi[l] 
EPTR"  [2]     :=   RET_ARGPTR".R    MM_EANDLE[2] 
RETURN 
END    MM_ACTIVATE 
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#(•  *1* 

*  MM   DEACTIVATE   PROCEDURE.    INVOKED    3Y   SEG   MGR'S  * 

*  DEACTIVATE    PROCEDURE.    PERFORMS    TYPE    CONVERSION  * 

*  OF    POINTERS,    LOADS    MESSAGE   ARRAY    FOR    IPC,    AND    PER-  * 

*  FORMS    IPC.    RETURNS    SUCCSSS_C0D2 .  * 

#  ;r 

vi„  -I*  »l*  »•*  *»>  *''  *•-  %•-  ***  *<*  «.*.  O-  O*  ■*•-  *•«  •.*.  -•-  ,'-  J*  «<U  »'"  *•*>  *■*  *■**  J*  *•>  «''  *.'.  *■'«•  «.'*  -»»  *l*  «.'»  -'*  »'*  -'■•  ^t"  *'-  »'*  »'■•  •>*'  "'-  »'*  «'*  »'*  »'■*  ■*'"  V*  *■*•*  -1"  *■'*  *•**  »'*  *'-  *  *  »'*  "''   *•*    t 

V  *|»  *>»  *»■» »»»  #»*  *,c  *,»  ?^»  *,»  „,-  „r  „,-  -i*-  -,-  -■»*  -«*»  »!•  or  *v  ***  *»*  *r  *i*  *v  *r  n*  *v*  *i*  *r  *r  *i*  *p  •r,"Y,"»■,'  •»*  n5  *p  *i*  n*  *r  *»*  *i*  *r»  ***  n*  'r  *»*  '\~*  *•*  ir  *i*  *i*  *»*  *v»  *^*  *i*  f 


MM_DEACTIVATE        PROCEDURE      (    D3R_ NO  SHORT_INTEGER 

EPTR  ~E_ARRAY    ) 

RETURNS  (    SUCCESS_CODE      BYTE    ) 

i    **#*    NOTE:  REENTRANT      PROCEDURE  ****    ! 

!    SAVE    LOCAL    VARIABLES    ON    STACK    TO   ENSURE   REENTRANT    ! 

LOCAL        D_MSG?TR         D_PTR 

COM_MSGEUF    C0M_MSG 
COM_MSGPTR    ^C0M_MSG 
SUC_CODE_PTR   SC..PTR 

ENTRY 

COM_MSGPTR    :=    #C0M    MSGBUF 

!    TYPE    CONVERT    TO    OVERLAY    ARG    LIST    ONTO    MSG    ARRAY    ! 

D_MSGPTR    :=   D   PiR    COM  MSGPTH 

!    LOAD    ARG    LIST    ONTO    MSG    ARRAY    ! 

D    MSGPTR~. DEACTIVATE    CODE    :=   DEACT IVATE_5EG_C0DE 

D   MSGPTR~.D_DBR   NO    :=    DBR_NC 

d!mSG?TR".D_MM   HANDLE  [0]     :=  HPTR*  [0] 

D    MSGPTR~.D_MM    HANDLE  [1]     :=  HPTR^fl] 

D    MSGPTR~.D    MM    HANDLE  [2]     :=   EPTR"  [2] 

PERFORM_IPC    (COM_MSGPTR) 

I    TYPE    CONVERT    TO    OVERLAY    MSG    ARRAY   ONTO    RET    ARG    LIST    ! 

SUC    C0DE_PTR    :=    SC_PTR    COM   MSGPTR 

SUCCESS    CODE    :=  SUC    CODE    PTR~. SUC    CODS 

RETURN 
END   MM    DEACTIVATE 
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*,*  *»■•  *»*  *r  *v»  'p  t*  *i%  *i*  *r  *.*  *v 


*  MM_SWAP_IN    PROCEDURE.    INVOKED    BY    SEGMENT    MANAGER'S  * 

*  SM   S^AP_IN    PROCEDURE.    PERFORMS    TYPE    CONVERSION    OE 

*  POINTERS,    DOADS    MESSAGE    ARRAY    EOR    IPC,    AND    PERFORMS  * 

*  IPC.    RETURNS    SUCCESS, CODS .  * 

»',  *l*  »i  -  ^'-   *>t   -■-  »'*.  ***  «.'*  *•*  »'»  »•*  ■>.'-  O-  »'^  %»*  •.'*  »•»  »t#  *i,  *'-  «L»  »'*  «■«  «t*  »t*  »'*  «f«  OU  «.'«•  »'»  *.'-  O*  *'»  -'»  «.'.  *' »  *'-■  ■<.'»  *.'*  *•*  i1  -  »■',  «'*  -.•-  -'  -  %•»■  - ' '  »'  -  ■»'»  ■»'*  »•*  • '»  *1*  »V  v'o  -■'*  OU  f 

vi'Ti'vT'l'T  *i*  i*  *r  *r  i*  *r  -ir  *i*  *»  *i*  *v*  *r  *»*  *r*  *v  n*  *»*  «v»  n*  *i*  ***  i*  *F  *i*  *•*  *r  *v  *t*  n*  *r*  *•*  «***  *r*  n*  »r  *»-  *r  *r  *r  *i*  *r  *r  *v  *r  *v*  •■*  'i*  *c  ■*!*  *r  " 


MM_SWA?.IM         PROCEDURE       (    DBR    NO 

SHORT    INTEGER 

EPTB 

"H  ARRAY 

ACCESS    MODE 

BYTE    ) 

RETURNS           (    SUCCESS_CODE 

BYTE    ) 

i   *.u  4*  -»*  Jiw 

1     T  *Y»  <1*  -I* 

NOTE:           REENTRANT      PROCEDURE 

5l*  *»*  *»*  V   T 

!    SAVE 

LOCAL    VARIABLES    ON    STACK    TO   ENSURE   REENTRANT    ! 

LOCAL 

SI    MSGPTR           SI    PTR 
COM   MSGBUE        COM    MSG 
COM_MSGPTR         "COM_MSG 

SUC~CODE_PTR    3C..PTR 

ENTRY 

COM   MSGPTR    :=   #C0M    MSGBUF 

j 

rYPE    CONVERT   TO    OVERLAY    ARG    LIST 

ONTO    MSG    ARRAY 

si. 

MSGPTR    :=   SI    PTR    COM    MSGPTR 

j    ; 

LOAD    ARG    LIST    ONTO    MSG    ARRAY     ! 

SI 

MSGPTR". SWAP    IN    CODE    :=   SWAP    IN 

SEG    CODE 

SI 

~M3GPTR".SI    MM    HANDLE [0]     :=   HPTR" 

[0]' 

SI 

MSGPTR". SI   MM    HANDLE [1]     :=  H?TR~ 

Ti] 

SI 

l*SGPTR".SI    MM   HANDLE [2]     :=   BPTR~ 

"[2] 

SI 

MSGPTR". SI    DBR    NO    :=   D3R    NO 

SI 

MSGPTR". SI    ACCESS    AUTE    :=   ACCESS 

_MODE 

pe: 

RFORM    IPC    (COM    MSGPTR) 

i 

rYPE    CONVERT    TO    OVERLAY    MSG    ARRAI 

"   ONTO    RET    ARG 

LIST 
SUC    CODE_PTR    :=   SC_PTR   COM   MSGPTR 
SUCCESS_CCDE    :=   SUC    CODE    PTR". SUC    CODE 
RETURN 
END   MM    SWAP    IN 
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«l«  »•*    -.'r   *•*  *V  *■'»  -tl*   »'*  ***  ***    -'*  »'*  »**   ***  *'*    '■**  **•*   v*?   **#  ***    »f*   ***    *■'*  *■'*    *■'*   V*   fcl* 
-,-.  *|*  »,«  *[»  *,■*  »("»  ^f«  'i*  *|»  <*(•%  *|»  *|»  *|,»  *!"*  ^|»  *(*  «•)■»  »|*  »|fc  *^«»   *-(»  *|»  *j»  *■(»  *(*  *|»  <f|% 


JU  -'  -  *  -  *•-  »•*  » 


MM   SWAP   OUT  PROCEDURE.    INVOKED   BY   SEGMENT   MANAGER'S 
SM~SWAP_OUT    PROCEDURE.    PERFORMS    TYP*   CONVERSION    OF 
POINTERS,    LOADS    MESSAGE    ARRAY   ECR    IPC,    AND   PERFORMS 
IPC.    RETURNS    SUCCESS    CODE. 


* 


,  V*    *''    ■'*     -''    ">''    »'*     -''    »'*•    *■'"      -'■'    **'     *>'*    "■'*    »**    »'*     *'*    «J»    »    -     ">''    »**     -'-    *'•*     «-'*    --''     *■'-    *■'*    «■**    ■~t'     •'■»     *•'"    »V    "»'»    -*'     -''     *■''    O*     *■*-     -■''•>'-      «'-    <.'*     »■>     -1»    *'*     fc'rf  -'*■     «■*  *,t*     •.'-»**      *'*    -'*    »■*     ~lr     -.'*    »'*    »'.»       ■ 

*  *|»  *l»  »,*  »p  *|*  rf  *p  -  ,-  *|»   »!%  »(<»  *|*  »!»  -,»  *|»   #!*  *|*  *|»  ^|>  #t»  *|»  *\«»   -,■*  *|»  *|*>  «!<•  *,»  *|*   *|-»  Jf  *|»  *|*   »,*  ^%  *(*  .-,>   *,*>  »,»  *|»   *4»  *j*  *^»  »,»  *|»  ^|"»  *|*  *|*  ^j*   »j»  *y*  *,*  »j*  *|*  »,•»  rf*   *|»  #(»     | 


MM    SWAP    OUT 


PROCEDURE   (  HPTR  ~H_ARRAY 

ACCESS_MODE    BYTE  ) 
RETURNS     (  SUCCESS_CCDE   EYTZ  ) 


!  ****  NOTE:     REENTRANT   PROCEDURE     ****  ! 

!  SAVE  LOCAL  VARIABLES  ON  STACK  TO  ENSURE  REENTRANT  ! 


LOCAL 


SO_MSGPTR  SO  PTP 

COM  MSG3UF  COM_MSG 

COM'MSGPIR  ~CCM_MSG 

5UC~CODE  PTR  SC  PTR 


ENTRY 

COM 


END 


_MSGPTR    :=    #COM__MSGIUF 
!    TYPE    CONVERT    TO   OVERLAY   ARG    LIST 
SO_MSG?TR    :=   SO_PTR    COM    MSGPTR 
!    LOAD    ARG    LIST   CNTO    MSG    ARRAY    ! 


ONTO 


SO   MSGPTR    .SWAP   OUT_ CODE    := 

S0~MSGPTR~.S0_MM_EANDLE[3] 
SC_MSG?TR~.SO_MM    HANDLE [ll 

so_msgptr".so!mm;handle[2] 
so  msgptr". so  dbr  no  :=  dbr 


SWAP  OUT   SEG 

=  HPTR~[0] 
=  EPTR~[l] 
=  HPTR"  [2] 
NO 


;g  ahray  ! 


CODE 


PERFORM, IPC   (COM_ MSGPTR) 

!    TYPE    CONVERT    TO    OVERLAY    MSG 

SUC    CODE_PTR    :=   SC_PTR    COM   MS 

SUCCESS    CODE    :=   SUC    CCDE_PTR" 

RETURN 

MM    SWA?    OUT 


ARRAY   ONTO    RET    ARG    LIST    ! 
JPTR 
.SUC    CODE 


139 


I  ?,»  *(£  rti   *(i  *,»  »,*  *,»  *I*  *(*  *,»  ?|*  *|*  *,■»  1,*  S|*.  i,C  1,1  J,*  i,x  !,»  J,C  J(*  r,«  Jp  *|"«  1(C  £,<•  -,C  »,»  !j%  ?J5  5,*  J,»  J,C  J|»  «>,■*  1|S  Sj*  *,»  *,*  1|%  5p  5|C  J,%  !,*  *|»  *,*  *,£  J|»  »,»  i,C  #|»  *,..  »,»  J,»  1,-.  *,-»  «,* 

*  MM   GET  DBR   VALUE.    SERVICE   ROUTINE   TEAT   RETRIEVES  * 

*  TEE    DBR    "VALUE*'    (IS   ADDRESS)    BASED    UPON    A    D3R_N0.  * 

ii*  *r 

)£C  *,*  »,..  ^»  ,,*  *,»  ?,%  »,-» »,»  *f  *■,-  n-  -,-',-  '■-  *p.  -,-  *,•»  *r  *i- 1*  *i*  *i*  *i*  T  n*  *i*  *»*  *»*  *»*•  *»*  *»*  nr  nr  -i-  *»% *r  *i*  *v  **»  *»*  *S*  *p  *4*  *r  *v  *r  nr  *r  *i* n*  *»-  *r*  *r  *r  *v  *p  np  I 

;  MM   GET   D3R_VALUE  PROCEDURE      (DBR    NO        SHOHT_IMTEGER) 

RETURNS  (EBR_VALUE  ADDRESS/ 

!    ****    NOTE:  REENTRANT      PROCEDURE  ****    ! 

!    SAVE    LOCAL    VARIABLES    ON    STACK    TO   ENSURE   REENTRANT    ! 

ENTRY 

DBR   VALUE    :=    #MMU    IMAGE    [DBR_NO] 

RETURN 
END   MM   GET    DBR    VALUE 


f»i,  *»*   '*  ,<,  «.>#  *'»  ••*■  hi* , o  *»*  >'*  v*  »•*  %.•*  »■*  »•*  •>**  »**  ***  »•*  »**  »*»  »**  »•*  *'*  %**  ***  »•*  »'*  "»'f  *•*  »'*  »**  •'*  »**  »'i»  *'•■  »'*  *'^  ***  *''  »'*  »•*  »'*  *'*  »**  *'*  »'*  *'**<#  si*  *'«  »■*  s>*  tb  ***  *■*  •>'» 
*i*  1*  *Tf*  *»*  *'*  ***  "V"  *»*  *P  *T*  *1-  *»*  *i*  *V*  *f*  *T*  'l**  *(*  *»*  1*  1*  *V  *P  *!"•  *l*  *»*  *P  *l*  *T*  *«*  *l*  *(*  *l*  *»*  *(*  'l*  *l*  *l*  *t*  *l*  *l*  T*  1*  1*  **»*  *»*  *l*  *l*  *K*  *l*  't*  *f  *V*  *!"*  *p  *X"  *»*  TP 

db  Of 

*  PER?ORM_IPC    PROCEDURE.    INVOKED   BY   DISTRIBUTED  * 

*  MEMORY    MANAGER    PROCEDURES.    DETERMINES    CURRENT  * 

*  MEMORY    MANAGER'S    VP    ID,    LOCKS   G_AST,    PERFORMS  * 

*  IPC    VIA    SIGNAL   AND  WAIT    PRIMITIVES,    AND   UNLOCKS  * 

*  THE    G..AST. 

1-'^     %t+      *'*         -'■*        «.'*      '.'*       .<»       »'»      -'•■      -'*       fclU      -.'-        ^'»       .'»      «'*      ->^       &l«      X1*       -.'^       -    '-       ^'*       »'-       -**        «'#      *'«      »'-       -'*       »•,       «'*       -**        -P-       1.'*       -'*       «;*        »'j       »<*      *'*         -I.*       »•,       ^ly        kV      *'<•       •■'»       *>''      »■''         J*      »'■•       •-'■»       »'■-       *■*«     *'«       O*      ^"^        -'*       «'*       ".'-       -'*       JU  ■ 

#l»  *|*  ^t*  *>|»  *,»  *l«  »,»  *l»  *l%  »p   *,»  *>f»  *(-«  *p  »|%  *(»  *^-»  *|*  »(•  -,*  *,*  »,<•  »|*  #,»  *J»  »l%  *!»  *p  -J1*  *,-   't*  *,*  *!■«  *,*  ^,x  «|<*  *,*   #|-.  *|«  *,-•  »,x  *|-»  *,»  *,»  *|%  *,»  *,*  *,>*  *p  *t»  *,^  *,»  *,%  *,»  »,%  *,-»  *,»  *,-.     J 


PERFORM. IPC  PROCEDURE         (CCM_MSGPTR  ^CCM_MSG) 

!    ****    NOTE:  REENTRANT      PROCEDURE  ****    ! 

!    SAVE    LOCAL    VARIABLES    ON    STACK   TO   ENSURE   REENTRANT    ! 

LOCAL  MMG-R_VP_ID 

ENTRY 

!    DETERMINE    MMGR   VP    ID    ! 

CPU    NO    :=    ITC_GET_CPU    NO 

MMGR_VP    ID    :=   MM    CPU   TABLE    [CPU    NO] 

K_L0CK    f#G   AST    LOCK) 

!    IPC    WITH   MEMORY    MANAGER    PROCESS    ! 

SIGNAL    (    COM_MSG?TR,    MMGR   VP    ID    ) 

WAIT    (    COM  MSGPTR    ) 

K_UNLOCK    (#G_AST_LOCK    ) 

RETURN 
END    PERFCRM_IPC 

END   DIST_MMGR 
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APPENDIX    E   -   NON-DISCRETIONARY   SECURITY   PLZ/SYS   LISTINGS 


NDS    MODULE 


COM ST A  NT 


TYPE 


TRUE  :=    1 

FALSE  :=    0 


ACCESS_CLASS 
C?TR 


INTERNAL 


CLAS51_?TR 
CLASS2_PTR 
CATS    REL 


RECOP.E    [    LEVEL      INTEGER 

CAT  INTEGER    1 

"ACCESS    CLASS 


C?TR 
CPTR 
INTEGER 


GLOBAL 


?.'««  *•<  »*n  *>*  »*»  »•*  »**  %*»  »l#  *'*  -,'*  *'*  »'*  *'*  ***  ■»**  OU  ■»'*  %»*  »•*  **>  «'*  ***  *'*  ■»•*  »•*  O*  *'*  "J*  »**  ***  •>•*  »**  ***  x'*  *.**  ***  ■.  '.»  *,•*  »**  »■*  »'*  %'«  »**    ^>»  »t»    ,1,  „l*  »t*  vl^  ,,1*  %l,  ^1^  ^t—  ^t^  »,(*  ^»rf    fcl* 
•  !>.  *|»  »|»  ^|*  »|»  *|»  *)*  *|*  *l»  »|»  *f»  *|»  *j*  *^»  *j»  *[•  rt-%  *|»  *(-*  *j*  *|»  *|»  »f»  *|»  »(*  *j»  »|*  »|»  *|*  »|*  *|»  *|*  #)»  *^  *l»  »|»  *(»  r|»  »|*  »|*  *j»  »j»  *|»  *|»  *,»  »i»  *|»  *|»  *(»  *|%  *|»  *^  »(*  *(»  #(»  *j*  *|*  *|» 

'1-  *l» 

*  CLASS_EO   PROCEDURE.    INVOKED   SY   VARIOUS    KERNEL  * 

*  PROCEDURES.    COMPARES    TWO    CLASSIFICATIONS    (LABELS)  •       * 

*  AND   DETERMINES    IF    THEIR    RELATIONSHIP    IS    EQUAL. 

*  RETURNS    A   TRUE/FALSE    CONDITION_CODE .  * 

f  *»* 

*.•*  -j*  *>-  ..I*,  o*  »'*  ***  «i*  »i*  •»■*  »i«  »i*  »•*  **»  »•#  »■*  *•*•  »'-  ^<*  »**  ***  %*»  v*  *'*  »•*  *'* *'*  J*  »'*  *'*  •>'*  *'■*  *'*  ■»'*  ■*'*  »'■»  **'*  »**  *'*  ***  »'*  V-  *'*  V*  »'*  ***  ***  ****  *'*  ^^  *•'*  *'*  *'»  *'■"  *'*  s!f  *■'*  »'*  I 

*>|»  *|»  *|»  *;*  *,»  *f»  *|*  *|"**|'  >|»  »(.  -,*  -,-  »,*V  *J*  #|*  *|»  »!*  *,"»  #|»  *,»  ^»  »|»  »,*  »,«*,»  *,-  »p  *t»  -,*»,«  *|«.  «!<•  *,»  #,-.  «|*  »j»  *j*  ^j»  *,-  *|*  *|»  *,.  »,-»  »(»  *f*  *|»  *j^  ^,»  *|*  #gl  *,»  »,-  »,*  *(»  ,,»  ,,-   y 


CLASS_EQ   PROCEDURE 
RETURNS 


(    CLASS  1  LONG 

CLASS2  LONG    ) 

(    CONDITION    CODE    RYTE    ) 


ENTRY 

IF    CLASS1    =    CLASS2    THEN 

CONDITION_CODE    :=   TRUE 
ELSE 

CONDITION    CODS    :=  FALSE 
FI 

RETURN 
END    CLASS    EQ 
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-  *r  *i»  nr  ■v  "i* 


*  CLASS_GE   PROCEDURE.    CALLED    BY    VARIOUS    KERNEL  * 

*  PROCEDURES.    COMPARES    TWO    CLASSIFICATIONS    (CLASS1  * 

*  AND   CLASS2)    AND   DETERMINES    IF    LA3EL1    IS    GREATER  * 

*  THAN    OR    EQUAL    TO    CLASS2.    RETURNS    TRUE/ FALSI    CONDI-  * 

*  TION    CODE.  * 

•v  •»*  *v  n*  *»"  i*  *i*  *v*  *»*  -v  *»*  *i*  *v  *v*  *i*  *i*  *t*  *y»  i*  *»"  a*  *»*  n*  'i*  i*  ***  **•  *»-  i*  ***  *f  *c  *»*  i*  i*  *»*•  *i*  *i%  i*  nr  *»*  *i*  *r  *v  *p  *p  *i*  *i*  *i*  *i*  *•*  *»*  *v*  *i*  *»*  *i*  *•*  *v*  f 


CLASS    GS    PROCEDURE 


ENTRY 


RETURNS 


CLASS1 
CLASS2 


LONG 
LONG    ) 


(    CONDITION    CODE    BYTE 


TYPE    CONVERSION    TO    ALLOW    OPERATIONS    ON    TEE    16    MOST 
AND    16    LEAST    SIGNIFICANT    BITS    OF    EACH    CLASS.    TEE 
16    MSMTS    ARE   THE    CLASS    LEVEL   AND    THE    16   LS?ITS 
ARE    TEE    CLASS    CATEGORY    (CAT). 


SEE    IF    CAT2 


CLASS1_PTR    :=    CPTR    #CLASS1 
CLASS2_PTR    :=   CPTR    #CLASS2 
!    COMPARE    CATEGORIES    (SET    COMPARISON 
!    IS    A    SUBSET    OF    CAT1. 

CATS.REL    :=   CLASft  1_PTR~ . CAT    OR    CLASS2_PTR~.CAT 
IF    CATS    REL    -   CLASS1_ PTR~  .CAT         !    THEN    CAT2    IS    SUBSET 
ANDIF    CLASS1_?TR~. LEVEL    >=    CLASS2    PTR~. LEVEL    TEEN 
!    LEVEL    COMPARISON    IS    SIMPLE    NUMERICAL    COMPARISON    ! 
CODE    :=   TRUE 

CODE    :=   FALSE 


CONDITION 

ELSE 

CONDITION 

FI 

RETURN 

END 

CLASS    GE 

END 

NDS 
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APPENDIX  G  -  SUMMARY  OF  REFINEMENTS 

The  following  new  procedures  were  added  to  the  Inner 
Traffic  Controller: 

(1)  ITC_GET_CPU_NO  procedure.  This  procedure  locates  and 
returns  the  current  CPU  number  (identification).  It  was  used 
in  segment  management  ty  the  distributed  memory  manager  to 
index  into  the  MM_CPU_TA£LS  to  find  the  memory  manager 
process  V?_ID  for  tne  current  processor.  This  VF_IL  was,  in 
turn,  used  as  an  argument  in  the  call  to  SIGNAL. 

(2)  ITC_GET_SEG_PTR  procedure.  This  service  procedure 
uses  an  input  segment  number  to  search  the  MMU_IMAGE  to  find 
the  base  address  (pointer)  for  that  segment.  It  was  used  in 
segment  management  to  find  the  base  address  of  the  segment 
used  in  a  process  for  its  EST. 

(3)  K_I0CK  and  EJJNLOCK  procedures.  These  procedures 
were  implemented  to  indicate  the  intention  to  eventually 
have  a  kernel  wait-lock  system.  K_I0CK  simply  calls 
SPIN_L0CK  in  its  present  design. 

The  following  changes  were  made  to  the  Inner  Traffic 
Controller: 

(1)  The  provision  for  a  "jump  table"  was  removed  when  a 
working  version  of  the  linker  was  introduced.  This  involved 
removing  the  constant  TC_PREEMPT_EANriER  and  adding  an 
"external"  declaration  for  the  TC_?REEMPT_HANLIEP  Procedure. 
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(2)  Minor  changes  were  necessary  in  three  procedures  to 
modify  the  message  size  from  one  word  to  a  sixteen  tyte 
array  (minor  changes  were  also  needed  in  the  declaration 
section).  The  procedures  effected  were:  ENTER_MSG_IIST , 
GET_FIRST_MSG,  and  WAIT.  The  changes  are  documented  in  the 
code  for  each  procedure. 

The  following  procedures  were  added  to  the  Traffic 
Controller: 

(1)  TC_GE7_PR0C_CIASS  Procedure.  This  procedure  locates 
and  returns  the  current  process's  classification  (i.e.,  it 
retrieves  the  SAC  entry  from  the  APT).  It  was  used  in 
segment  management  to  retrieve  the  PR0C_CLA3S  for  the 
Segment  Manager. 

(3)  TC_G2T_DBR_N0  Procedure.  This  procedure  returns  the 
current  DB?._NO  value  from  the  APT.  The  Segment  Manager  used 
this  procedure  to  octain  the  DEH_N0  to  pass  to  the  memory 
manager. 

The  version  of  the  Traffic  Controller  shown  in  Appendix 
H  is  a  "stun"  of  Beitz'  [9]  actual  work.  This  stut  contains 
the  elements  of  tne  TC  Module  needed  for  proper  operation  of 
the  segment  management  demonstration. 
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APPENDIX  E  -  SEGMENT  MANAGEMENT  DEMONSTF. ATION 

A.   DESCRIPTION 

The  Seg_MsT.Demo,  as  stated  "before,  is  built  onto  Reitz' 
Sync .Demo  (wnich  was  designed  for  a  different  purpose  than 
segment  management,  obviously).  The  functions  illustrated  by 
the  present  demonstration  are:  (l)  virtual  processor 
synchronization  and  (2)  segment  management  function 
performance.  The  listings  of  tne  modules  involved  are  in 
appendices  A-F  and  I.  It  is  suggested  that  the  ASM  versions 
te  used  as  references?  PIZ/SYS  versions  served  as 
"pseudo-code"  during  detailed  design,  "but  are  untested.  The 
narrative  discussion  of  tne  demonstration  context  and 
sequence  is  presented  below.  The  output  generated  at  each 
process  entry  point  will  identify  the  signaller  in  each  case 
and  the  action  the  current  process  takes.  The  following 
actions  are  illustrated  (viz.,  "simulated")  ir.  this 
demonstration.  Note  that  this  simulation  uses  the  ITC 
SIGNAL/WAIT  primitives  instead  of  the  TC  ADVANCE /AWAIT 
primitives  that  are  not  yet  implemented. 

1.  An  I/O  interrupt  signals  tne  10  process  that  a 
packet  from  the  host  is  ready.  The  10  process  is 
scheduled,*  it  reads  tne  packet  (output:  "IC:  Eeceive 
Command")  and  signals  the  FM  process  (output:  "10: 
Signal  FM  (Create)"),  passing  the  command  ( CREATE  is 
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simulated).  The  10  process  calls  Wait,  thus  blocking 
itself  while  waiting  for  a  signal  from  the  FM 
process . 

2.  The  FM  process  is  scheduled  (output: 
"lO=Signaller" ) ;  it  interprets  the  command 
(simulated)  as  CREATE  and  thus  calls  CREATE_SEG  in 
the  Segment  Manager  (output:  "FM:  Call 
Kernel (Create) ") .  The  normal  input  arguments  for 
C?.EATE_SEG  are  passed  in  this  call. 

3.  CREATE_SEG  validates  the  CREATE  request  and  then 
calls  MM_CREATE_ENTRY  in  the  Distributed  Memory 
Manager. 

4.  MM_CREATE_ENTRY  signals  the  memory  manager 
process  (MM  process)  and  calls  WAIT,  thus  Hocking 
itself  while  waiting  for  a  signal  from  the  Mw 
process . 

5.  The  MM  process  is  scheduled  (output: 
"Kernel=Signaller  (for  FM)");  the  mainline  code 
interprets  the  function  code  and  calls  the 
CREATS_SNTRY  procedure  for  action.  When  action  is 
complete  (output:  "MM:  CREATE_ENTRY" ) ,  the  procedure 
returns  to  the  mainline  code.  The  MM  process  signals 
the  return  success  code  in  a  message  to  the  FM 
process,  then  calls  WAIT  to  wait  for  the  next 
signal . 

6.  The  FM  process  is  scheduled  (output:  "Return  fror 
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Kernel").  The  I'M  process  then  signals  completion  of 
CREATE  to  the  10  process  and  calls  WAIT  (output: 
"IM:  Signal  10"). 

7.  The  10  process  is  scheduled  (output: 
"FM=Signaller" ) .  It  signals  the  IM  process  to  cause 
a  "read"  to  occur,  i.e.,  the  same  pattern  as  in 
steps  b.  through  e.  occur  for  MAKE_KNOWN  and  SWAP_IN 
prior  to  the  FM  process  signalling  back:  to  the  10 
process  that  the  "read"  was  completed.  This  "read" 
is  defined  strictly  for  this  test  and  is  not 
equivalent  to  a  typical  Read_File  packet. 
3.  The  10  process  will  then  be  again  scheduled  and 
will  perform  the  same  functions  as  did  the  FM 
process  (i.e.,  will  call  MAKE_O0WN  and  SM_SWAP_IN 
sequentially)  for  the  same  segment. 

9.  The  10  process  will  again  be  scheduled  and  will 
signal  the  FM  process  to  perform  the  same  sequence 
as  described  in  g.  for  SM_SWA.?_CUT  and  TERMINATE. 

10.  The  10  process  will  again  be  scheduled  and  will 
repeat  step  h.  with  SM_SWAP_OUT  and  TERMINATE. 

11.  The  10  process  will  again  be  scheduled  and  will 
cause  the  FM  process  to  repeat  steps  b.  through  e. 
to  delete  (DELETE_SEG  called)  the  segment. 

12.  The  entire  loop  repeats  forever. 


167 


B.   INITIALIZATION 

The  description  of  the  intialization  of  the  databases  is 
presented  in  figures  containing  the  appropriate  memory  data. 
Reference  to  the  previous  descriptions  of  these  databases 
and  the  type  declarations  will  be  useful.  Figure  9  is  the 
initialized  Active  Process  Table.  Figure  10  is  the 
initialized  Virtual  Processor  Table.  Figure  11  is  partial 
representation  of  the  initialized  KST  for  the  FM  process 
(93C0)  and  the  10  process  (97££K  Figure  12  is  partial 
representation  of  the  initialized  MPu^IMAGE.  Figure  13  is 
partial  representation  of  the  initialized  process  stack 
segments.  Figure  14  is  the  corresponding  link  command  line 
and  response,  and  the  Imager  command  line  and  response. 
Figure  15  is  the  load  command  lines  and  response,  and  the 
register  initializations.  Figure  16  is  the  output  (as 
displayed  on  the  CRT  screen)  generated  by  the  demonstration. 
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